MAL-2026-12887 Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)

On require of the package's main entry, helpers.js runs a bootstrap() routine that downloads an OS-specific binary from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev) with a DNS TXT fallback under *.dl.wel1.ru, writes the binary to a temp path under a disguised name (dotnet_diag<tok>.exe on Windows,.cache_<tok> on POSIX), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true, stdio:"ignore"}).unref() (or spawn("cmd"…) on Windows). Endpoint hostnames are assembled by Array.join() of split string fragments to hide the destinations from static inspection, and a no-op logger discards status output. A stamp file (/tmp/.analytics_state or %TEMP%\analytics_state) is written to rate-limit re-execution, and environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked as a telemetry cover story. No signature or hash verification is performed on the downloaded payload.