MAL-2026-12959 Malicious code in bnpl-blocks-independent-bnpl-main-banner (npm)

index.js requires./polyfill on module load. polyfill.js selects a platform-specific branch (linux_x64, linux_arm64, darwin, win32), assembles destination hostnames via per-character string joins (e.g. Cloudflare Workers hosts under oob-worker.cf*.workers.dev and a discovery domain under sdk.dl.wel1.ru), downloads an opaque binary, writes it to /tmp or %TEMP% under a disguised name such as.cache<rand> or dotnet_diag<rand>.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. A DNS TXT fallback reconstructs the payload from base64-chunked TXT records served across numbered subdomains (c.<domain> for count, i.<domain> pieces joined and base64-decoded) when HTTPS retrieval is blocked. The destinations are non-publisher, string-obfuscated hosts; the fetched bytes are executed on the installer's machine at library load with no signature, hash, or publisher verification.