MAL-2026-12950 Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded *.workers.dev endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback via resolvers under dl.wel1.ru (sdk./ext./pkg./net.). Hostnames and resolver domains are assembled at runtime from split-string fragments to evade static analysis. The downloaded bytes are written to a temporary path under a deceptive name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and detach-spawned via /bin/sh -c "<path> &" or cmd.exe /c start. Cover-story environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT) and cache/diagnostic naming disguise the dropper as telemetry. Reachable on first require() of the package; no user opt-in required.