MAL-2026-12725 Malicious code in devplatform-nx-pvm (npm)

On require() of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a disguised filename (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. The C2 hostnames are assembled from split string arrays (e.g. ["oob-worker.cf100-416.work","ers.dev"].join("")) to evade static scanners, and a cover file named analytics_state is used as a run marker. If the HTTPS fetches fail, the code falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru, retrieving a chunk count from c.<domain> and base64-encoded payload chunks from N.<domain>, concatenating and decoding them, then executing the resulting binary. The dropper is skipped when specific telemetry opt-out environment variables are set, further indicating stealth. The package presents itself as a trivial library shim, and index.js unconditionally requires _compat, so installing and importing the package auto-executes the attacker-controlled binary on the installer's machine.