MAL-2026-13031 Malicious code in boxy-bus-providers (npm)

On require() of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-.workers.dev through cf103-.workers.dev) with a DNS-TXT base64 fallback from *.dl.wel1.ru, writes the payload to /tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',…). C2 hostnames and dangerous API names are string-split and reassembled at runtime (e.g., ['oob-worker.cf102-baf.wor','kers.dev'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static detection. A sibling module lib/telemetry.js contains an identical fetch-decode-chmod-exec chain with a base64-reassembled payload delivered over DNS, staged as a secondary/updater dropper. The declared package purpose does not require downloading and executing an unpinned remote binary from anonymous workers.dev infrastructure.