MAL-2026-13235 Malicious code in bigops-product-list (npm)

index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined via.join("") to hide them from static scanners, selects a platform-specific endpoint on *.workers.dev (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) and *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads an opaque binary over HTTPS with a DNS-TXT base64-chunked fallback, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A per-host filesystem cooldown marker (.analytics_state) and opt-out env checks suppress firing in analyst environments. A second copy of the same dropper is shipped in lib/telemetry.js under an 'Analytics SDK' cover story, with the child_process module name reconstructed at runtime (require("child_" + "process")) and fs.chmodSync accessed via string concatenation. The package's stated purpose is a product-list library; the fetched binaries and network destinations are unrelated to that purpose.