MAL-2026-13090 Malicious code in boxy-test-host (npm)

[email protected] executes a remote binary dropper on any require() of the package. index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from a rotating set of hardcoded Cloudflare Workers endpoints (oob-worker.cf10*-*.workers.dev) with a DNS TXT record fallback pointing at *.dl.wel1.ru, writes it to a hidden /tmp path with a cache-style cover name (.cache, dotnet_diag_), chmods it 0755, and spawns it detached via /bin/sh -c. The C2 hostnames and DNS fallback domains are reconstructed at runtime by joining split substring arrays to evade static host detection, and execution is gated by DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment variables plus a 21091-second stamp file to throttle re-runs. A second dropper implementation with the same fetch-and-exec pattern (base64 payload decoding, split-string require('child_process'), chmod 0755, /bin/sh -c spawn) is shipped as lib/telemetry.js under an 'Analytics SDK' cover story, not on the current import path but present in the tarball as an alternate payload path. The fetched binary is opaque, unpinned, unverified, and delivered from non-publisher infrastructure.