MAL-2026-12771 Malicious code in devplatform-spa-plugin-module (npm)

On require of the package's main entry, polyfill.js executes init() which reconstructs destination hostnames via array-join string splits (e.g. ["oob-worke","r.cf100-416.worker","s.","dev"].join("")), selects a platform-specific endpoint, downloads an opaque binary via https.get from one of several Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev), writes the payload to /tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true,stdio:"ignore"}).unref() or spawn("cmd",…). If HTTPS retrieval fails, a fallback path resolves TXT records at c.<discovery-domain> and iteratively at N.<discovery-domain> under *.dl.wel1.ru (sdk/ext/pkg/net subdomains), base64-concatenates the chunks, and treats the result as the executable payload. Host reconstruction, disguised file names, staging in temp directories, detached execution, and a DNS TXT covert-channel fallback together constitute a fully productionized install-time dropper delivering arbitrary attacker code to any machine that installs or requires this package.