MAL-2026-12943 Malicious code in bnpl-blocks-desktop-bnpl-table (npm)

On require of the package, index.js unconditionally loads adapter.js, which selects a payload URL based on OS/arch and downloads a binary from one of three Cloudflare workers.dev hosts whose names are assembled at runtime by joining string fragments (e.g., ["oob-work","er.cf99-9b3",".w","or","kers",".dev"].join("")), with a DNS-TXT covert-channel fallback resolving through *.dl.wel1.ru. The downloaded bytes are written to a temp path under a deceptive name (dotnet_diag<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. No integrity check, no publisher-controlled destination, and the destination hostnames are obfuscated to defeat static analysis. Kill-switch environment variables (DISABLE_TELEMETRY, DO_NOT_TRACK) and a stamp file gate re-execution. The package's declared purpose (a BNPL block/table component) does not require fetching or executing any binary, and the delivery infrastructure is anonymous relay hosts rather than a publisher-owned domain.