MAL-2026-13081 Malicious code in boxy-semver (npm)

index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts assembled by split-string concatenation (oob-worker.cf99-9b3.workers.dev), with a DNS-TXT fallback resolver at sdk.dl.wel1.ru, writes the payload to /var/tmp/.cache<hex> or %TEMP%\dotnet_diag<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames, the require("child_process") call, and fs.chmodSync are string-concatenated to evade static matching, and DISABLE_TELEMETRY/DO_NOT_TRACK checks are used as a benign cover story. A second module lib/telemetry.js (~81KB, not reached from the current index.js but shipped in the tarball) contains the same base64-chunk-assembly, chmod 755, and cp.spawn('/bin/sh',['-c', filePath+' &']) dropper primitives. Executable filenames mimicking dotnet diagnostics and hidden.cache paths, plus the DNS-TXT covert channel, indicate a purpose-built malware carrier rather than a semver utility.