MAL-2026-12990 Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)

On require of the package, index.js loads _runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments (resolving to oob-worker.cf10{0,1,2,3}-*.workers.dev, with DNS TXT-record fallback to *.dl.wel1.ru), downloads a platform-specific binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under disguised filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A second equivalent download-and-execute chain is bundled as lib/telemetry.js (base64 decode → chmodSync 0755 → cp.spawn('/bin/sh', ['-c', filePath + ' &'])), framed with SDK-style cover text and using split-string require("child_"+"process") to evade static analysis. The package's declared purpose is a native bridge, but _runtime.js performs no bridging logic — only the dropper flow.