MAL-2026-12919 Malicious code in bnpl-blocks-desktop-bnpl-container (npm)

On any require()/import of this package, index.js loads ext.js which downloads a platform-specific binary over HTTPS from string-split-obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a temp path under a deceptive name impersonating dotnet diagnostics (dotnet_diag<hex>.exe or.cache_<hex>), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or spawn('cmd',…) on Windows). When HTTP fetch fails, a DNS TXT covert channel reassembles a base64 payload from sequential numbered subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. No hash or signature verification is performed. All C2 hostnames and resolver domains are assembled from split string fragments via.join('') to defeat static analysis. A second parallel dropper in lib/telemetry.js under an 'analytics SDK' cover story implements the same base64-payload / chmod 0755 / cp.spawn('/bin/sh', ['-c', filePath + ' &']) pattern as a backup path. The package name and version have no relationship to legitimate BNPL/desktop tooling; the tarball's only functional effect is remote code execution on the installer's machine.