MAL-2026-12886 Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)

index.js requires./bootstrap.js on load. bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). On failure it falls back to a DNS-TXT covert channel reassembling a base64 payload from TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to a disguised path in /var/tmp or %TEMP% (.cache<uid> on POSIX, dotnet_diag<uid>.exe on Windows), chmod 0o755 on POSIX, and detached-spawned via /bin/sh -c '<file> &' or cmd /c start /b. Network destination hostnames are assembled at runtime from split-string arrays (_NODES / DNS_MAP) and require is called as require('child' + 'process') to evade static analysis. On-disk artifact names and env-var opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) impersonate a benign telemetry SDK, and lib/telemetry.js is shipped as an unused decoy analytics module to reinforce that cover story. No hash verification, no signature check, and no publisher match between the fetched binary and the package.