MAL-2026-13019 Malicious code in bnpl-blocks-stories-of-block (npm)

On require() of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of attacker-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a temp path with a disguised name (dotnet_diag<hex>.exe on Windows,.cache_<hex> on POSIX), chmods it to 0755, and spawns it detached via cmd.exe /c start or /bin/sh -c. Destination hostnames are reassembled at runtime via array split +.join("") to evade static analysis, and child_process is required as require("child_"+"process"). If the HTTPS mirrors fail, bootstrap.js falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru): it queries a count record and N sequential TXT records, base64-decodes and concatenates them into an executable buffer, then writes and spawns it with no signature or hash verification. Cover-story naming (analytics_state marker, dotnet_diag*.exe, DISABLE_TELEMETRY/DO_NOT_TRACK env opt-outs) does not alter that this is arbitrary remote code execution on the installer's host on module load.