MAL-2026-12996 Malicious code in bnpl-blocks-mobile-bnpl-link-group (npm)

On require of the package, support.js selects a platform-specific asset path and fetches a binary over HTTPS from obfuscated *.workers.dev hosts assembled at runtime via string-fragment.join('') (e.g. 'oob-worker.cf101-adf.workers.dev', 'oob-worker.cf103-070.workers.dev'), with a DNS TXT chunked fallback via *.dl.wel1.ru (e.g. 'sdk.dl.wel1.ru'). The fetched bytes are written to a temp directory under a disguised name (dotnet_diag<hex>.exe on Windows,.cache_<hex> on Unix), chmod 0755 is applied on Unix, and the file is spawned detached via cmd.exe /c start /b or /bin/sh -c. Destination hosts are split into fragments and reassembled to evade string scanning. An execution-stamp file suppresses re-running. The package advertises itself as a native bridge but ships no native source, so the only effect of importing it is dropping and executing attacker-controlled code on the installer's host.