MAL-2026-12948 Malicious code in bnpl-blocks-fonts (npm)

The package presents itself as a fonts helper but its index.js unconditionally requires./ext, which on module load fetches a platform-specific binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev) with a DNS-TXT fallback channel over *.dl.wel1.ru (chunked base64 delivered via resolveTxt on c.<domain> and N.<domain>). Hostnames are split into array fragments and joined at runtime to evade static analysis. The fetched bytes are written to a disguised temp path (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &']) or cp.spawn('cmd',…). No hash or signature is verified and the payload is opaque. A parallel dropper in lib/telemetry.js mirrors the same design (base64 chunk decode, chmodSync via property-name splitting, shell spawn) as an alternate loader. The declared 'fonts' / 'analytics/telemetry' purpose does not match fetching and executing anonymous remote binaries at require time.