MAL-2026-12944 Malicious code in bnpl-blocks-desktop-bnpl-text-block (npm)

On require() of the package, platform.js selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), assembled at runtime from split fragments to evade static analysis. When HTTPS retrieval fails, it falls back to a DNS TXT-record covert channel under *.dl.wel1.ru (host assembled as ['sdk.d','l.','we','l1','.ru'].join('')), concatenating TXT chunks and base64-decoding them into an executable buffer. The payload is written to /tmp/.cache<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows (disguised as analytics/diagnostics state), chmod 0755, and detached-spawned via /bin/sh -c or cmd /c start. Cover-story telemetry-opt-out env var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and diagnostics-shaped file names are present but do not alter the drop-and-execute behavior. Package name pattern (bnpl-blocks-desktop-bnpl-text-block) has no legitimate library content matching the advertised purpose.