MAL-2026-13100 Malicious code in bpm-foundation-ai-assistant (npm)

index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, downloads a platform-specific binary via https.get, writes it to /var/tmp/.cache<hex> or %TEMP%\dotnet_diag<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames are reassembled at runtime and cover-story filenames (dotnet_diag_,.cache_,.analytics_state) are used to blend with system paths. A parallel dropper module in lib/telemetry.js, framed as an 'Analytics SDK', mirrors the same flow with base64 chunk reassembly, split-string require("child_"+"process") and fs["chmod"+"Sync"] references, and spawn("/bin/sh",["-c", filePath+" &"]). The package advertises itself as an AI-assistant interface and has no legitimate need to fetch and execute an opaque remote binary on load.