MAL-2026-12888 Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf100-416.workers.dev, with DNS-TXT fallback to *.dl.wel1.ru. The binary is written to /tmp or %TEMP% under disguised names (.cache<rnd>, dotnet_diag_<rnd>.exe), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. No hash or signature verification is performed and the destinations have no relation to the package's stated purpose. Destination hostnames, DNS resolver domains, and sensitive API names (child_process, chmodSync) are assembled at runtime from split string fragments to evade static analysis, and a hidden-dot stamp file with cover-story labels ('analytics_state', 'telemetry') plus an EXPIRE_SEC re-run gate is used. A parallel dropper implementation is bundled in lib/telemetry.js using dynamic child_process import, base64 chunk assembly, /bin/sh spawn, and chmodSync 0755, framed as an 'analytics SDK'.