MAL-2026-13027 Malicious code in book-collect (npm)

On require('book-collect'), index.js loads loader.js which downloads a platform-specific binary from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT base64 fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are reconstructed at runtime via split-array.join("") and function names are built by concatenation ('child'+'process', 'chmod'+'Sync') to evade static analysis. The fetched bytes are written to /var/tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe (disguised as a dotnet diagnostic tool), chmod 0755, and spawned detached via '/bin/sh -c <path> &' or 'cmd.exe /c start /b'. No hash or signature verification is performed. A second copy of the same drop-write-chmod-exec chain lives in lib/telemetry.js under an 'Analytics SDK' cover story, with an env-var opt-out (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT) that does not change the default install behavior.