MAL-2026-13230 Malicious code in bigops-operator-status (npm)

On require() of this package, index.js loads support.js which selects a platform-specific asset path (linux/darwin/windows), fetches a binary payload from one of four Cloudflare Workers hostnames whose strings are assembled at runtime from split arrays to evade static analysis (oob-worker.cf102-baf.workers.dev, cf99-9b3, cf103-070, cf101-adf), writes the bytes to a disguised path under /tmp or the Windows Temp directory (e.g. dotnet_diag.exe,.cache_), chmods 0755, and spawns the resulting binary detached via /bin/sh -c or cmd. If HTTPS retrieval fails, _support.js falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it resolves c.<domain> for a chunk count, then queries 0.<domain>..N.<domain>, base64-decodes the concatenated TXT contents into a binary, and executes it the same way. The destinations are not publisher-controlled, the payload bytes are opaque, and the hosts are obfuscated by string splitting — the shape is a full-host remote code execution dropper triggered at module load.