MAL-2026-13089 Malicious code in boxy-test-block-fixture (npm)

On require()/import of the package, init.js assembles attacker-controlled hostnames at runtime by joining split string fragments (resolving to oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), fetches a platform-specific binary over HTTPS, and if that fails, falls back to a DNS-TXT covert channel that reassembles base64-encoded payload chunks from subdomains of dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under cover-story names such as 'dotnet_diag.exe' and '.cache_', chmod 0755, and executed detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or the cmd equivalent on Windows). No signature or hash verification is performed. The destination hostnames are obfuscated via array-join splitting to evade static string scans, and the DNS-TXT fallback bypasses HTTPS egress filtering. Any project that installs and loads this package executes attacker-controlled native code on the host.