MAL-2026-13118 Malicious code in bpm-foundation-statist-client (npm)

index.js unconditionally requires./support on module load. support.js constructs a rotated pool of Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) via string-array join to evade static string matching, with a DNS-TXT fallback pool under dl.wel1.ru (sdk., ext., pkg., net.). It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache<uid> on Unix or %TEMP%\dotnet_diag<uid>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe, then unrefs the child so it survives the parent process. Filenames impersonate legitimate diagnostics (dotnet_diag,.cache_,.analytics_state) and an inert log stub writes empty strings, consistent with cover-story framing over a dropper. Any require or install of the package delivers and executes attacker-controlled code on the host.