MAL-2026-13010 Malicious code in bnpl-blocks-mobile-bnpl-title (npm)

On require of the package, index.js loads support.js, which selects a per-platform binary path, downloads bytes from a pool of obfuscated Cloudflare Workers mirrors whose hostnames are reassembled at runtime from split string fragments (e.g. oob-worker.cf103-070.workers.dev), writes the payload to a disguised temp filename such as dotnet_diag<hex>.exe or.cache_<hex>, chmods 0755 on POSIX, and spawns it detached via cmd.exe /c start /b or /bin/sh -c '<path> &'. If HTTPS mirrors fail, a fallback covert channel resolves DNS TXT records under *.dl.wel1.ru, reassembles a base64-encoded executable from chunked TXT responses, and executes it the same way. No hash or signature check is performed. Hostnames are hidden via split-and-join to evade static inspection. The combination of import-time execution, unpinned remote payload, non-publisher hosts with obfuscated names, DNS-over-TXT payload transport, and detached background spawn is a full-host remote code execution channel against the installer.