MAL-2026-12760 Malicious code in devplatform-spa-plugin-analytics (npm)

[email protected] advertises itself as an analytics library, but on require() its main entry loads adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers origins (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a hidden name (e.g..cache<hex>, dotnet_diag_<hex>.exe), chmods it 0o755, and spawns it detached via spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',…). Destination hostnames and the DNS fallback domain are assembled at runtime by array.join to evade static extraction (e.g. ['oob-w','orker','.cf101-adf.worker','s.dev'].join('')). A DNS-TXT covert channel provides fallback delivery: the loader resolves TXT records under c.<domain> and <i>.<domain> at *.dl.wel1.ru, concatenates base64 chunks, and writes and executes the reassembled binary. No native source ships in the package, no build step exists, and the fetched bytes are opaque and unrelated to any publisher endpoint. The behavior fires automatically on require() of the package, producing full-host code execution on the installer under an attacker-controlled binary.