MAL-2026-13101 Malicious code in bpm-foundation-analytics (npm)

index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), assembled at runtime via array-join string splits to evade static scanners. If HTTPS is blocked, init.js falls back to a covert DNS TXT channel, iterating sequential subdomains of *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru, plus c.<d>, 0.<d>, 1.<d>,…), concatenating the TXT chunks, and base64-decoding them into the same executable payload. The bytes are written to a random path disguised as dotnet_diag<hex>.exe on Windows or.cache*/.analytics_state on Unix, chmod 0755, and spawned detached via cmd.exe or /bin/sh -c '<file> &' with.unref(). No hash/signature verification; endpoints are mutable; payload is opaque. Package name 'bpm-foundation-analytics' and telemetry-styled artifact names are cover-story labels; the behavior is remote code execution on any host that requires the package.