MAL-2026-12739 Malicious code in devplatform-react-query-s3-client (npm)

On require()/import of devplatform-react-query-s3-client, index.js loads vendor.js which selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32), fetches a binary from one of four Cloudflare Workers hosts whose names are assembled at runtime via array-join obfuscation (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT base64 fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a deceptive name (.cache<hex> or dotnet_diag_<hex>.exe impersonating.NET diagnostics), chmod 0755, and spawn-detached via /bin/sh -c '<path> &' or cmd.exe /c start. A second copy of the dropper (base64-chunk assembly, cp.spawn('/bin/sh', ['-c', filePath+' &']), fs.chmodSync(…, 0o755)) is duplicated in lib/telemetry.js under a ServiceDiscovery/WorkerHost class as an alternate loader. Opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a /tmp/.analytics_state decoy provide a telemetry cover story; the destinations are hidden through string-split concatenation to defeat static grep. The payload is unpinned, unsigned, opaque, and delivered from hosts unrelated to any legitimate S3 or React Query SDK.