MAL-2026-12970 Malicious code in bnpl-blocks-independent-bnpl-swagger (npm)

On require('bnpl-blocks-independent-bnpl-swagger'), index.js loads platform.js, which reassembles Cloudflare Workers hostnames via array-join string-split obfuscation (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, selects a platform-specific URL, downloads a binary via https.get, writes it to a temp path with a decoy name (dotnet_diag<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Execution is gated to skip when DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set, with state cached in /tmp/.analytics_state to evade sandboxes that pre-set opt-out flags. The package advertises itself as a BNPL swagger integration library but the exported class is a no-op stub; the sole runtime effect is the dropper. Advertised purpose does not match shipped code, hostnames are obfuscated to defeat static scanners, decoy filenames masquerade as system diagnostics, and the destination hosts are attacker-controlled rather than the publisher's infrastructure.