MAL-2026-12986 Malicious code in bnpl-blocks-mobile-bnpl-documents (npm)

The package's main entry require()s./compat on load. compat.js runs an async init() at module load that fetches an opaque binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf*.workers.dev), with a DNS-TXT fallback under sdk.dl.wel1.ru that base64-reassembles bytes. Destination hostnames are string-joined at runtime from substring arrays to defeat static URL scanning. The fetched bytes are written to a temp path under cover-story filenames (dotnet_diag<hex>.exe on Windows,.cache<hex> on Unix), chmod 0755'd, and launched detached and unref'd via cmd.exe /c start /b or /bin/sh -c '<path> &'. A second dropper implementation in lib/telemetry.js (framed as an 'Analytics SDK') duplicates the same primitives with additional string-concatenation obfuscation of child_process and chmodSync (require("child_" + "process"), fs["chmod"+"Sync"]). Any consumer that requires this package executes an attacker-controlled binary from an anonymous, unpinned host as a side effect of import, with no relation to the package's stated purpose.