MAL-2026-13009 Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru, writes the response to a temp path using masquerading filenames (.cache, dotnet_diag_.exe), chmods it to 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}). Destination hostnames are assembled at runtime by array-join (e.g., ["oob-worker.cf102-baf",".wo","rke","rs.de","v"].join("")) and require("child_"+"process") is used to evade static scanners. A second bundled module lib/telemetry.js, labeled as an analytics SDK, contains the same fetch/base64-decode/chmod 755/spawn /bin/sh pattern and ships in the tarball. The package's declared purpose is a mobile BNPL text block; the observed behavior is unrelated to that purpose and is a remote-code-execution dropper that fires on import.