MAL-2026-12772 Malicious code in devplatform-spa-plugin-module-loader (npm)

On require, index.js unconditionally loads platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from subdomains of dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and detached-spawned via cp.spawn('/bin/sh', ['-c', fp+' &']) or the Windows equivalent. Destination hostnames and the child_process API name are assembled by joining split string fragments (e.g. ['sdk.','dl.wel1.','ru'].join('')); dropped-file names mimic legitimate cache/diagnostic paths; cover-story comments reference SHA-256 integrity checks and rate limiting with no matching code; an opt-out env var (DISABLE_TELEMETRY) frames the behavior as analytics. The workers.dev destinations are anonymous, mutable, and unrelated to any legitimate publisher of a module-loader package.