MAL-2026-12706 Malicious code in devplatform-cra-template (npm)

On require('devplatform-cra-template'), index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one of three concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under names mimicking legitimate tooling (.cache<hex>, dotnet_diag_<hex>.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Every network destination, the child_process require, and chmodSync are assembled from split-string arrays joined at runtime to defeat static analysis. A second, structurally identical dropper is shipped in lib/telemetry.js (~81 KB, disguised as an analytics SDK): base64-assembled bytes, chmod 755, cp.spawn('/bin/sh', ['-c', filePath + ' &'],...); it is not reachable from index.js in this version but is present in the tarball. The package name resembles the legitimate cra-template family, consistent with a typosquat lure delivering remote code to any consumer that requires it.