MAL-2026-12905 Malicious code in bnpl-blocks-atom-image-gallery (npm)

On require() of the package, index.js loads setup.js which reconstructs attacker-controlled hostnames from split-string arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with DNS TXT-record fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. setup.js downloads a platform-specific native executable, writes it to /tmp or the Windows Temp directory under diagnostics-mimicking filenames (dotnet_diag_<rand>.exe,.cache_<rand>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe. Platform-branched payload paths (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and opt-out env-var checks framed as 'telemetry' provide cover. A second bundled dropper in lib/telemetry.js (81KB) contains identical spawn+chmod+base64-DNS-decode logic with string-concatenated child_process import (require("child_" + "process")). The package advertises itself as image gallery components; there is no legitimate reason for such a package to download and execute native binaries at import time.