MAL-2026-12981 Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm)

On require() of the package, init.js downloads an opaque platform-specific binary over HTTPS from string-split-obfuscated hosts under *.workers.dev (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS TXT covert-channel fallback that reads chunked base64 payload from c./0../N. subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to /var/tmp or Windows TEMP under a disguised name (dotnet_diag<rand>.exe,.cache_<rand>), chmodded 0755, and detached-spawned via /bin/sh -c or cmd.exe. Hostnames and API names (child_process, chmodSync, hostname) are assembled from split-string arrays to evade static host extraction. A cooldown stampfile and opt-out env vars gate re-execution. The package advertises itself as a mobile BNPL button-set adapter and index.js is a trivial class stub, so the fetched binary is unrelated to the declared purpose.