MAL-2026-12729 Malicious code in devplatform-nx-svelte (npm)

On require of the package, compat.js constructs C2 hostnames by joining split string fragments to evade static inspection, downloads a platform-specific executable from Cloudflare Workers subdomains (oob-worker.cf1**-***.workers.dev), and falls back to a DNS-TXT covert channel that reassembles base64 chunks from TXT records at c.<subdomain>.dl.wel1.ru / N.<subdomain>.dl.wel1.ru across sdk/ext/pkg/net.dl.wel1.ru. The retrieved bytes are written to a temp path with a disguised name (e.g. dotnet_diag.exe,.cache_), chmodded 755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Cover-story naming (markerPath 'analytics_state', a DISABLE_TELEMETRY opt-out, and a no-op _l logger) frames the dropper as telemetry. The fetch targets are not the package's publisher, the payload is opaque, and there is no integrity verification. The package name resembles legitimate Nx/Svelte tooling but the shipped code performs unauthenticated remote code execution on every installer that imports it.