MAL-2026-13232 Malicious code in bigops-plugin-notification-builder (npm)

On require()/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) and, on HTTPS failure, reassembles the payload from base64-encoded DNS TXT chunks under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to a disguised temp path (dotnet_diag<uid>.exe /.cache_<uid>), chmod 0755'd, and spawned detached via spawn("/bin/sh",…) or spawn("cmd",…). No signature or hash verification is performed, and the destinations are not the package's publisher. Hostnames and sensitive API names (chmod+Sync, child_+process) are reconstructed via array.join("") splitting to evade static analysis. A parallel copy of the same dropper primitives ships in lib/telemetry.js under an 'analytics SDK' cover story.