MAL-2026-12749 Malicious code in devplatform-s3-uploader (npm)

On require() of the package, index.js loads helpers.js which unconditionally runs a start() routine that selects a platform-specific asset path, fetches an opaque native binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under a cover-story name (e.g. dotnet-diag under /var/tmp or TEMP), chmod 0755, then executed detached via spawn('/bin/sh', ['-c', path + ' &']) or spawn('cmd',…) on Windows. No hash or signature verification. Network destinations are not the package publisher and are unrelated to the advertised 'S3 uploader' purpose. Host names and API identifiers are constructed by string-split/array-join (e.g. ['oob-worker.cf100-416.workers.','de','v'].join(''), require('child' + 'process'), fs['chmod' + 'Sync']) to evade static analysis. A secondary module lib/telemetry.js, presented as an 'analytics SDK', ships parallel dropper primitives (base64 chunk reassembly, bracket-obfuscated chmod to 0755, cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true})) — co-shipped fallback attack infrastructure.