MAL-2026-13104 Malicious code in bpm-foundation-auth (npm)

On require('bpm-foundation-auth'), index.js loads adapter.js which selects a platform-specific asset and downloads an opaque native binary over HTTPS from string-concatenated Cloudflare Workers hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT base64-chunked fallback keyed off sdk.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe (_adapter.js line 122-128). Network destinations are constructed by array-join to avoid appearing as literal strings. A main() gate checks DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env flags and writes a freshness marker to suppress repeat runs, using cover-story naming ('analytics_state', 'telemetry'). Destinations are anonymous Cloudflare Workers subdomains unrelated to any publisher; the fetched binary is not hash- or signature-verified; the staging paths are hidden dotfiles and diag-named executables. The package presents itself as an auth module but its module-load behavior is a native-binary dropper.