MAL-2026-12707 Malicious code in devplatform-create-nx-spa (npm)

[email protected] ships an index.js main entry that silently require()s _bridge.js, which on load assembles Cloudflare Workers hostnames (oob-worker.cf10{0,1,2,3}-*.workers.dev) and a fallback DNS-TXT channel to *.dl.wel1.ru from split-string arrays joined at runtime, downloads an unsigned opaque binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755s it, and spawns it detached via spawn('/bin/sh', ['-c', <path>+' &'], {detached:true}) or spawn('cmd',...). The behavior is disguised as "analytics" and gated by an /tmp/.analytics_state timestamp. The child_process identifier and destination hostnames are assembled from 3-4 substring pieces (['oob-worker.cf103-070.wor','ke','rs.dev'].join(''), require('child_'+'process')) to defeat static string matching. The package presents itself as a lightweight Nx SPA scaffolder, but its main module's only load-time effect is to fetch and execute attacker-controlled code on the installer's host.