MAL-2026-12893 Malicious code in bnpl-blocks-atom-bnpl-skeleton (npm)

On require of the package's main entry, init.js fetches a platform-specific binary from obfuscated Cloudflare Workers hostnames (assembled by joining split substrings, e.g. oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT chunked-base64 fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised filenames (dotnet_diag<token>.exe on Windows,.cache_<token> on Unix), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe. No source, hash, or signature is verified. A parallel dropper bundle in lib/telemetry.js replicates the same write-chmod-spawn primitive behind an analytics/telemetry cover story, with additional string-splitting obfuscation of sensitive APIs (require("child_"+"process"), fs["chmod"+"Sync"]). Any consumer importing this package executes arbitrary attacker-controlled native code on the host.