MAL-2026-12712 Malicious code in devplatform-http-client (npm)

On require() of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init(). The routine selects a platform-specific payload path and fetches a native binary from Cloudflare Workers subdomains whose hostnames are reconstructed from split string fragments (e.g. ["oob-worker.cf102-baf.workers.","de","v"].join("")). If the HTTPS fetch fails, it falls back to a DNS TXT covert channel against *.dl.wel1.ru: it resolves c.<domain> for a chunk count, batches TXT lookups against 0..N.<domain>, concatenates the responses, and base64-decodes them into an executable buffer. The fetched bytes are written to /tmp or %TEMP% under a disguised filename (.cache<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and spawned detached via cmd.exe start /b or /bin/sh -c. The package is presented as an HTTP client wrapper, a purpose that requires no native-binary download and no DNS TXT smuggling; the destinations are anonymous infrastructure (workers.dev subdomains and an unrelated.ru domain), string-split to defeat static string scanning, and the dropped filenames impersonate telemetry/diagnostic tooling. Installing or loading this package yields remote code execution on the installer machine.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.