MAL-2026-12762 Malicious code in devplatform-spa-plugin-beaver (npm)

On require(), the package's init.js selects a platform-specific URL from a set of Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are assembled from split-string fragments to evade static grep, downloads an opaque binary payload with no hash or signature verification, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows using filenames disguised as system diagnostics, chmods 0o755, and detach-spawns it via /bin/sh -c or cmd /c start with unref() so the child outlives the require. A DNS-TXT covert channel over subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru provides a fallback transport that reassembles base64 chunks from numbered TXT records, bypassing HTTP egress filtering. Execution is gated by cover-story opt-outs (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) and a ~6h TTL marker at /tmp/.analytics_state or %TEMP%\analytics_state so the dropper fires once per fresh host to reduce detection surface. The fetched bytes have no relation to the advertised 'spa plugin' function, and the fetch destinations are neither the npm registry nor a publisher-matched vendor host.