MAL-2026-12926 Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

The package presents itself as a 'logging middleware' but its index.js unconditionally requires loader.js on module load. loader.js selects a per-OS asset and fetches it over HTTPS from a randomized list of anonymous Cloudflare Workers hostnames (reconstructed via split-string concatenation such as ["oob-wor","ker.cf100-416.workers",".de","v"].join("")). If HTTPS fails, it falls back to a DNS TXT covert channel that queries c.<host> then sequential numeric subdomains under *.dl.wel1.ru, concatenates the TXT chunks, and base64-decodes them into an executable payload. The fetched bytes are written to a disguised path under /var/tmp or %TEMP% (e.g. dotnet_diag*.exe,.cache*), chmod 0755 on Unix, and executed detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd.exe. No hash or signature verification is performed, destinations are not publisher-controlled, and hostnames and the require("child_"+"process") call are string-split to evade static scanners. The Logger export is a cover story shadowing an install/import-time remote-code-execution dropper.