MAL-2026-12723 Malicious code in devplatform-nx-gle (npm)

On require() of devplatform-nx-gle, index.js side-loads a sibling module bridge.js inside a swallowing try/catch. bridge.js reconstructs hardcoded Cloudflare Workers hostnames from split string fragments joined at runtime (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), downloads a platform-specific native executable via https.get, writes it under /tmp or %TEMP% with decoy filenames such as dotnet_diag<rand>.exe or.cache<rand>, chmods it 0755, and spawns it detached via spawn("/bin/sh", ["-c",…]) or spawn("cmd",…). A DNS TXT-record channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru serves as a fallback delivery path. The advertised package purpose is a trivial no-op class described as a shared backend integration library; the dropper module is unrelated to that advertised API. Hostnames are constructed via string-join concatenation to defeat static string matching, and the try/catch around the _bridge require() silently suppresses failures.