MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

The package's main entrypoint (index.js) unconditionally requires./compat.js, whose top-level main() reconstructs obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and vendor-lookalike domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) via array-join splits, downloads a platform-specific executable for linux/darwin/win32/arm64, writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag.exe,.cache_), chmods 0755, and detached-spawns it via /bin/sh -c or cmd /c start. A DNS-TXT chunked base64 channel is used as a fallback delivery path. A second, structurally identical dropper is bundled at lib/telemetry.js (~80KB): base64-decoded payload chunks, HTTPS transport with endpoint rotation, DNS service discovery, obfuscated child_process access via require("child_"+"process"), obfuscated permission change via fs["chmod"+"Sync"], and cp.spawn("/bin/sh", ["-c", filePath+" &"]). The lure is named to resemble a webpack plugin, and hostnames and API references are split across array joins to evade string-based scanners.