MAL-2026-13268 Malicious code in devplatform-test-pvm-is-odd (npm)

[email protected] is a lure package whose index.js requires./_bootstrap.js on load. _bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-over-TXT fallback to *.dl.wel1.ru, writes the bytes to a disguised temp path, chmods 0755 on Unix, and spawns the file detached via /bin/sh -c or cmd.exe. Hostnames, the require('child_process') identifier, and fs.chmodSync are assembled at runtime from split string fragments (e.g. ['oob-worke','r.cf99-9b3.worke','rs.dev'].join('')) to evade static scanners, and a stamp file gates repeat execution. A second, structurally identical dropper is shipped in lib/telemetry.js (81KB) with chunked base64 payload assembly, string-concatenated fs.chmodSync, and cp.spawn('/bin/sh', ['-c', filePath+' &']); it is not reachable from index.js in this version but is present in the tarball. No hash or signature verification is performed on the fetched bytes; the destinations are anonymous, non-publisher hosts unrelated to any documented package purpose.