MAL-2026-12994 Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

On require() of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three hardcoded workers.dev hosts (oob-worker.cf101-adf.workers.dev and siblings), with a DNS-TXT base64 chunked fallback via sdk.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a masquerading name (.cache<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmod 0755'd on POSIX, and spawned detached-and-unref'd via child_process.spawn("/bin/sh", ["-c", path+" &"]) or spawn("cmd",…). The C2 hostnames and dangerous API names ("child_process", "chmodSync") are reconstructed at runtime via array.join()/string concatenation to evade static analysis. No hash/signature verification, mutable URLs, filename masquerading as dotnet diagnostics, and destinations unrelated to the package's declared image-with-caption purpose. A sibling lib/telemetry.js reuses the same string-reconstruction anti-analysis shape.