MAL-2026-13071 Malicious code in boxy-mmb-deps-pvm-plugin (npm)

index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev), downloads a platform-specific binary via https.get, and — if HTTPS fails — falls back to a DNS TXT covert channel that reassembles base64-chunked payload bytes from c.<domain> and <i>.<domain> lookups against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<hex> or %TEMP%\dotnet_diag<hex>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. lib/telemetry.js ships a second copy of the same dropper under an 'analytics-sdk' cover story, loading child_process through require("child_"+"process") and calling fs["chmod"+"Sync"] to further hide the pattern. The package's stated 'plugin' purpose does not match the shipped payload-delivery infrastructure.