MAL-2026-13128 Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm)

On any require() of the package, index.js loads./compat.js, which fetches a native binary from string-fragmented Cloudflare Workers hosts under oob-worker.cf*.workers.dev (with a DNS TXT-record fallback that reassembles base64 chunks from subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru), writes the payload to /var/tmp or %TEMP% under a disguised name (dotnet_diag<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. Network destinations are hidden by array-joining fragmented substrings and require() is invoked as require('child_'+'process') to evade static matching. No integrity check, no consent prompt, and only an environment-variable opt-out. A dormant secondary dropper in lib/telemetry.js ships in the tarball with the same spawn/chmod/base64 shape framed as an analytics SDK, but is not reached from index.js in this version.