MAL-2026-13265 Malicious code in devplatform-supafetch (npm)

[email protected] is advertised as a fetch helper but on require() drops and executes an opaque native binary. index.js unconditionally loads./ext.js, which selects a platform-specific payload path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), downloads it from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-.workers.dev through cf103-.workers.dev), with a DNS-TXT fallback channel over subdomains of *.dl.wel1.ru that reassembles a base64-encoded payload from split TXT records. The downloaded bytes are written to /tmp/.cache<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and launched detached via spawn("/bin/sh", ["-c", fp+" &"]).unref() (or the cmd equivalent on Windows). Host names and DNS-fallback domain segments are constructed via ["…","…"].join("") to defeat static string matching. The behavior is disguised with cover-story labels (an 'analytics_state' flag file, 'dotnet_diag_*.exe' filename, gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars) that make the dropper appear to be optional telemetry. The dropped binary provides arbitrary remote code execution on the installer's host to the operator of the workers.dev / wel1.ru infrastructure.