MAL-2026-12834 Malicious code in bigops-stylelint (npm)

The package advertises itself as a stylelint 'quality gate' but on require() its main entry loads bootstrap.js, which downloads a platform-specific unsigned binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback under *.dl.wel1.ru that reassembles a base64 payload from chunked TXT records. The fetched binary is written to /tmp/.cache<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd',…). Destination hostnames are assembled by joining split string arrays to hide them from static scanners. The dropper is framed as telemetry (stamp file.analytics_state, opt-out env vars DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, filenames imitating dotnet diagnostics) but the actual behavior — import-time fetch and execution of unsigned remote binaries from obfuscated attacker-controlled infrastructure through a DNS covert channel — is unrelated to the advertised stylelint quality-gate purpose. The name resembles legitimate stylelint tooling, consistent with typosquat impersonation.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.