MAL-2026-13001 Malicious code in bnpl-blocks-mobile-bnpl-picture-gallery (npm)

On require(), bootstrap.js selects a platform-specific asset path and downloads a binary from one of several Cloudflare Workers hostnames whose names are assembled at runtime by joining substring arrays (e.g. 'oob-w'+'orker.cf103-070'+'.workers.dev'), with a DNS-TXT covert-channel fallback under *.dl.wel1.ru that reassembles a base64-encoded payload from numbered TXT records if HTTPS retrieval fails. The fetched bytes are written to /tmp or %TEMP% under disguised names (e.g. 'dotnet_diag.exe', '.cache_'), chmod 0755, and spawned detached via child_process (spawn('cmd'…) or spawn('/bin/sh',…)). The package advertises itself as a 'platform adapter' / 'picture gallery' — remote binary execution is not the stated purpose. A second, cover-story-labeled ('analytics-sdk') copy of the same dropper ships at lib/telemetry.js with parallel HTTPS+DNS discovery, base64 chunk assembly, chmod 0755, and spawn('/bin/sh',['-c', filePath + ' &']).