MAL-2026-12829 Malicious code in bi-core-bi-core-core (npm)

On require() of the package, index.js triggers _compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled oob-worker*.workers.dev Cloudflare Workers hosts (with a DNS TXT fallback via *.dl.wel1.ru subdomains), writes them to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns them detached via /bin/sh -c on Unix or cmd.exe /c start /b on Windows. Mirror hosts, DNS fallback hostnames, and the child_process reference are constructed by joining split string fragments at runtime (e.g. ["oob-work","er.cf100-41",...].join(''), require("child_" + "process")) to defeat static string scans. The package presents itself as a trivial base framework module — index.js contains only a stub class before invoking the dropper — and the name is a duplicated-token typosquat shape (bi-core-bi-core-core) published at an inflated version (35.8.5) with no legitimate functionality.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.