MAL-2026-12839 Malicious code in bigops-tcrm-permissions (npm)

On require of bigops-tcrm-permissions, index.js loads runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under a hidden/decoy name, chmods the file 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed, and the destinations are not associated with the package publisher. Destination hostnames and dangerous API names (require("child"+"process"), fs["chmod"+"Sync"]) are reassembled at runtime from string fragments to evade static matching. lib/telemetry.js contains a duplicate dropper flow (base64-assembled chunks, write, chmod 755, spawn /bin/sh detached) under an 'Analytics SDK' cover story, providing a second execution path against the same C2 infrastructure. The advertised purpose is a permissions SDK; dropping and executing native binaries from unrelated infrastructure is inconsistent with that purpose.