MAL-2026-13094 Malicious code in boxy-use-calls (npm)

index.js unconditionally requires bridge.js, whose top-level main() runs on import. bridge.js selects a platform-specific payload path, downloads an opaque binary via https.get from one of several string-split Cloudflare-Workers hosts assembled by.join('') (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to a disguised filename under /tmp or %TEMP% (e.g..cache<hex>, dotnet_diag<hex>.exe), chmods it 0755, and detached-spawns it via /bin/sh -c or cmd /c start with.unref(). A fallback channel queries DNS TXT records under c.<domain> and sequentially-numbered subdomains of *.dl.wel1.ru to reassemble a base64-chunked payload when HTTPS is blocked. A 21376-second replay-suppression stamp is written under an 'analytics_state' key. No pinning, no signature check, no publisher-matching source. A separate lib/telemetry.js file presents an 81 KB 'analytics SDK' that is never referenced by index.js or _bridge.js and shares DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env-var names with _bridge.js, serving as cover-story camouflage for the dropper.