MAL-2026-12995 Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)

index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linux_x64, linux_arm64, darwin, or win32 and downloads it from Cloudflare Workers hostnames reconstructed at runtime via string-array joins (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback on subdomains of dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Additional obfuscation is present: dynamic property assembly (fs["chmod"+"Sync"], require("child_"+"process")), a cover-story marker file named.analytics_state, and a sibling lib/telemetry.js that presents Sentry-like SDK comments while duplicating the dropper primitives. The package's declared purpose ("platform adapter") does not exist as functionality — index.js exports a trivial no-op class, package.json declares no dependencies, and the only substantive behavior is the dropper. Any consumer that require()s this package receives full-host code execution from attacker-controlled infrastructure.