MAL-2026-12736 Malicious code in devplatform-react-hooks (npm)

On require() of the package's main entry (index.js -> _init.js), the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments joined at runtime (e.g. ['oob-worker.cf99-9b3.w','orkers.de','v'].join('')), rotates through oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS-TXT fallback under *.wel1.ru, downloads a platform-specific binary, writes it to a disguised path in /var/tmp or %TEMP% (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Cover-story comments frame the behavior as cache/telemetry and offer DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var opt-outs. A second module, lib/telemetry.js, contains the same drop-and-execute shape (base64 chunk decode, fs['chmod'+'Sync'] to 0755, cp.spawn('/bin/sh', ['-c', filePath+' &'])) but is not reached from the declared main. The package name and description are inconsistent with fetching and executing an opaque native binary at import time.