MAL-2026-13106 Malicious code in bpm-foundation-bundle-optimization (npm)

Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames (oob-worker.cf10*.workers.dev) and DNS-fallback domains (*.dl.wel1.ru) from split-string arrays joined at runtime, downloads a platform-specific binary over https.get, writes it to /tmp or %TEMP% under decoy names (.cache<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT covert channel reconstructs the payload from base64 chunks served under c.<domain> and N.<domain> when the primary hosts are unreachable. A sibling lib/telemetry.js contains a parallel dropper implementation (fs.chmodSync 0755, cp.spawn '/bin/sh -c… &', base64-chunk reconstruction) staged in the tarball but not on the auto-executed graph of this version. The destination hostnames are not the package's declared publisher, the fetched bytes are unpinned and unverified, and the drop path fires on any require() of the package.