MAL-2026-13022 Malicious code in bnpl-blocks-utils (npm)

On require(), index.js loads loader.js, which assembles a Cloudflare Workers hostname (oob-worker.cf*.workers.dev) via runtime.join('') string reassembly, fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag<hex>.exe on Windows,.cache_<hex> on Linux/macOS), chmods 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',…). If the HTTPS fetch fails, _loader.js falls back to a DNS-TXT covert channel: it resolves TXT records on subdomains of dl.wel1.ru (host fragments also assembled via.join('')), concatenates the returned chunks, base64-decodes them, writes the resulting bytes as an executable, and spawns it. There is no hash or signature verification of the fetched payload. The package presents itself as a generic 'utility functions' library; the remote-binary-drop behavior does not match that stated purpose. Multiple structural fingerprints stack: runtime-obfuscated attacker-controlled hostnames, unpinned mutable payload URLs, DNS-TXT payload staging (a network-egress evasion channel), disguised filenames in system temp directories, and detached execution triggered at module load.