MAL-2026-12752 Malicious code in devplatform-select-user (npm)

On require(), the package loads bridge.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), writes it to /var/tmp or %TEMP% under cover-story names such as.cache<hex> and dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &']) on POSIX or cmd on Windows. Destination hostnames are reconstructed at runtime from split character arrays (['oob-worker.cf99-9b3.worke','rs.','de','v'].join('')) to evade string-based scanners. A DNS fallback channel resolves TXT records under *.dl.wel1.ru (assembled the same way in _DNS_MAP) to retrieve or exfiltrate chunked data when HTTPS is blocked. The package's advertised purpose is a 'select user' UI helper — there is no functional reason for it to fetch and execute an opaque native binary from anonymous Cloudflare Workers subdomains at import time. Cover-story comments ('Shuffle endpoints to distribute load', 'Clean up temporary files') and a DISABLE_TELEMETRY opt-out gate frame the dropper as diagnostics. Installing or importing this package results in attacker-controlled code executing on the host.