MAL-2026-12783 Malicious code in devplatform-spa-route-tree (npm)

On require() of devplatform-spa-route-tree, index.js loads loader.js which downloads a platform-specific binary from hostnames assembled via array-join string splits — Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows (masquerading as.NET diagnostic tooling), chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or the Windows cmd equivalent. Destination hostnames are split across array literals and reassembled at runtime to evade static matching, and environment-variable checks for DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as cover framing. The fetched binary is opaque, unpinned, unverified, and served from non-publisher infrastructure.