MAL-2026-13243 Malicious code in bigops-products-mobile (npm)

On require('bigops-products-mobile'), index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over HTTPS from obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) reconstructed at runtime by joining fragmented string arrays, with a DNS-TXT chunked fallback under *.dl.wel1.ru. The bytes are written to a disguised path ('.cache<hex>' on POSIX, 'dotnet_diag_<hex>.exe' on Windows to impersonate a Microsoft diagnostic tool), chmod 0755'd, and detach-spawned via /bin/sh -c or cmd.exe with stdio ignored and unref()'d. No hash or signature verification is performed, the package's declared purpose ('device integration') has no dependencies and no relation to this behavior, and a persistence stamp is written to '.analytics_state' with telemetry/analytics-styled comments and DISABLE_TELEMETRY/DO_NOT_TRACK env checks used as cover. lib/telemetry.js ships a second, structurally identical fetch->base64->chmod 755->/bin/sh spawn dropper implementation (not currently wired from index.js but present in the tarball). Installing and importing this package yields remote code execution on the installer's host under attacker control.