MAL-2026-13202 Malicious code in dwhetlfront-dwhetlfront-core (npm)

On require() of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT chunked-base64 fallback under {sdk,ext,pkg,net}.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under a cover-story filename (dotnet_diag.exe,.cache_), chmods 0755, and spawns the file detached via cp.spawn('/bin/sh', ['-c', path + ' &'], {detached:true}) or spawn('cmd',…). Destination hostnames are reconstructed at runtime via array-join splits (e.g., ['sdk','.d','l.wel1','.r','u'].join('') and ['oob-w','orker.cf100-416.worker','s.','dev'].join('')) and API names such as 'child_' + 'process' are string-concatenated to evade static analysis. A lock file gates repeat execution and an opt-out env var serves as a cover story. A parallel dropper implementation exists in lib/telemetry.js (base64 chunk assembly, sh -c spawn, chmod 755 via bracketed 'chmod'+'Sync'); it is not reached from index.js in this version but is bundled in the tarball.