MAL-2026-13234 Malicious code in bigops-procedure-player (npm)

On require(), index.js loads loader.js, which reconstructs delivery hostnames at runtime via array.join("") (e.g. oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and fetches an OS-specific binary via https.get. A fallback path assembles the payload from base64 chunks in DNS TXT records under *.dl.wel1.ru (a count record at c.<domain> and per-chunk records at <i>.<domain>). The received bytes are written to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod'd 755 via a string-concatenated fs["chmod"+"Sync"], and executed detached via cp.spawn("/bin/sh", ["-c", fp+" &"]) or the cmd equivalent. Filenames masquerade as system cache/diagnostic artifacts and the delivery hosts are unrelated to the package publisher. lib/telemetry.js contains a duplicate fetch->chmod 755->detached-spawn dropper body that is not reached from index.js in this version but mirrors the same loader shape.