MAL-2026-13087 Malicious code in boxy-temper (npm)

index.js require()s bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are assembled at runtime via Array.join('') (e.g. 'oob-worker.cf103-070.workers.dev', 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf99-9b3.workers.dev'), downloads an opaque binary over HTTPS, writes it to /tmp on unix or %TEMP% on windows under disguised names (.cache<hex>, dotnet_diag<hex>.exe), chmods 0755, and spawns it detached with stdio ignored via cp.spawn('/bin/sh', ['-c', fp+' &']) or the cmd equivalent. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel, issuing chunked TXT queries to attacker-controlled subdomains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), base64-reassembles the responses into a binary, writes it to disk and executes it. Hostnames are split into fragments and joined at runtime specifically to evade static string matching, and opt-out env vars are labeled as 'analytics' as a cover story. The package's advertised purpose is a 'boxy temper microservice adapter' but the main class is a no-op stub; the only real behavior is the loader. No hash or signature verification is performed on the downloaded payload.