MAL-2026-12908 Malicious code in bnpl-blocks-consts (npm)

Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific executable, writes it to /tmp (Unix) or the Windows TEMP directory under decoy names (dotnet_diag<hex>.exe,.cache_<hex>,.analytics_state), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start (spawn calls at _polyfill.js lines 121 and 125; child_process required at line 119). Payload host list is assembled at runtime by split-join to defeat static string scanning, resolving to Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev. When HTTPS fetches fail, the code queries a DNS TXT chunk-count record at c.<domain> and then loops through 0.<domain>..N-1.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-concatenates the TXT payload, and executes the reconstructed binary. The dropper honors DO_NOT_TRACK / DISABLE_TELEMETRY environment variables to masquerade as telemetry. Purpose (a trivial constants module) is inconsistent with fetch-and-execute of an opaque binary from obfuscated hosts, and every distinguishing signal (host string-splitting, decoy artifact names, DNS covert-channel fallback, detached spawn) is characteristic of a supply-chain implant.