MAL-2026-13120 Malicious code in bpm-foundation-tcs-configs (npm)

On require() of the package, index.js loads adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) and *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache<hex>,.analytics_state, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed at runtime by splitting the domain into fragments and joining them with.join('') to defeat static URL scanners, and code comments falsely label the behavior as telemetry/CDN negotiation. A DNS-over-TXT fallback channel reassembles a base64 payload from numbered TXT records when HTTP fetch fails. There is no version pin or hash verification on the downloaded binary, a TTL cache suppresses repeat downloads to reduce detection, and DISABLE_TELEMETRY-style environment variables act as an evasion switch. The dropped filenames impersonate system components (dotnet diagnostics, analytics cache).