MAL-2026-13056 Malicious code in boxy-make-tokens-map (npm)

index.js unconditionally requires./loader on module load. loader.js reconstructs three Cloudflare Worker hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) via array-join string obfuscation, selects a platform-specific path, downloads an executable over HTTPS, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag<hex>.exe on Windows (a decoy filename impersonating a Microsoft diagnostic tool), chmods it 0755, and spawns it detached and unref'd via /bin/sh or cmd. A DNS-TXT channel under *.dl.wel1.ru (hostnames such as sdk.dl.wel1.ru also reassembled via.join('')) reconstructs a base64-encoded payload from numbered subdomains as an out-of-band delivery/fallback channel. A marker file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a TTL rate-limits re-execution. The stated purpose ('token map') does not match any of the observed behavior, and 'telemetry'/'analytics' comments provide cover-story framing.