MAL-2026-12759 Malicious code in devplatform-spa-plugin-ability (npm)

On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (chunk count in c.<domain>, N shards concatenated and base64-decoded into an executable buffer). Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf102-baf.worke","rs.d","ev"].join("")). The fetched binary is written to disguised paths (/var/tmp/.cache<hex>, %TEMP%\dotnet_diag_<hex>.exe, /pkg/package.exe|-arm64|loader_mac), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start with no hash or signature verification. A lib/telemetry.js decoy file and an.analytics_state rate-limit stamp plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env-var gates provide cover-story framing; the delivered payload is unrelated to the package's stated purpose (an "SPA plugin ability SDK"). Installing or requiring this package executes attacker-controlled code on the installer host.