MAL-2026-13224 Malicious code in bigops-microfrontend (npm)

index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev), selects a platform-keyed endpoint for linux/darwin/win32, downloads an opaque native binary over HTTPS with a DNS-TXT fallback channel (c.<domain> for chunk count, i.<domain> for base64 chunks under *.dl.wel1.ru), writes it to /tmp or %TEMP% under disguising names such as.cache<rand> and dotnet_diag<rand>.exe, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd. The behavior fires on any require() of the package, giving full arbitrary code execution on the installer's host. lib/telemetry.js additionally bundles a parallel dropper implementation with the same HTTPS+DNS-TXT service discovery, base64 chunk assembly, chmod 0755, and detached shell spawn, framed as an analytics SDK; it is not on the auto-execute path in this tarball but ships the same attack machinery. The destination hostnames are obfuscated via split-string concatenation and the Windows drop name impersonates a.NET diagnostic tool.