MAL-2026-13032 Malicious code in boxy-client-loader (npm)

On require('boxy-client-loader'), index.js loads platform.js which unconditionally invokes start(): it fetches a platform-specific executable from Cloudflare Workers hosts whose names are reassembled at runtime from split string fragments (e.g. 'oob-worker.cf101-adf.wo'+'rkers.dev'), with a DNS-TXT-over-base64 fallback that reads a chunk count from c.<domain> TXT and reassembles the payload from numbered N.<domain> TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under masquerading names such as 'dotnet_diag.exe' and '.cache_', chmod 0755 on POSIX, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. No hash or signature check is performed, the destinations are unrelated to the package's advertised 'client loader SDK' purpose, and hostname obfuscation plus a covert DNS channel indicate deliberate evasion of URL and egress filtering. Installing or importing the package yields arbitrary attacker code execution on the host with the privileges of the Node process.