MAL-2026-12980 Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)

index.js requires./loader on load. loader.js assembles network destinations at runtime by concatenating split string fragments (e.g. ['oob-worker.cf103','-070.worke','rs','.dev'].join('')) to hide endpoints on oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, and falls back to a DNS-TXT covert delivery channel at *.dl.wel1.ru that reads a chunk count from c.<domain> and reassembles base64 payload chunks from numbered subdomains. The downloaded opaque, unpinned, unverified binary is written to /var/tmp or %TEMP% under cover-story names ('dotnet_diag<hex>.exe', '.cache<hex>', 'analytics_state'), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. The dropper honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables to suppress execution as an anti-analysis measure. The package's stated purpose ('device integration') is unrelated to the fetched executable and no legitimate functionality is shipped.