MAL-2026-12711 Malicious code in devplatform-hooks (npm)

On require() of devplatform-hooks, index.js loads init.js, which selects a platform-specific payload URL and fetches an executable from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev). The destination hostnames are assembled at runtime from split string fragments joined together to evade static inspection. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel: it queries c.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru for a chunk count, iteratively resolves N.<domain> TXT records, concatenates and base64-decodes the responses into a binary. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmod 0755, then executed detached via cp.spawn("/bin/sh", ["-c", path+" &"], {detached:true}) or the Windows equivalent. The package name, the obfuscation of destinations, the DNS-TXT covert transport, the disguised drop paths, and the detached execution together constitute a remote code execution dropper triggered on any install or import of this package.