MAL-2026-12753 Malicious code in devplatform-snarkdown (npm)

On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), and falls back to a DNS-TXT covert channel that reconstructs a base64 payload from chunked TXT records under wel1.ru subdomains (sdk/ext/pkg/net.dl.wel1.ru). The fetched bytes are written to a temp path under a masquerading name (e.g..cache* / dotnet_diag_*.exe), chmodded 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and resolver domains are assembled at runtime by joining string fragments to defeat static analysis. A timestamped lockfile at /tmp/.analytics_state (or %TEMP%\analytics_state) gates re-execution for ~21201 seconds, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars cause early return — a sandbox/CI evasion posture wrapped in telemetry cover-story naming. The package advertises itself as a markdown parser; downloading and executing a native binary at require time is unrelated to that purpose.