MAL-2026-13271 Malicious code in devplatform-utils (npm)

[email protected] ships an index.js whose main module require()s bootstrap.js, which on load downloads a platform-specific binary payload from string-split-obfuscated Cloudflare Workers endpoints (e.g. oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback via *.dl.wel1.ru. The payload is written to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Destination hostnames are assembled at runtime by.join('') on fragmented string arrays (NODES, DNS_MAP) to evade static string scans, and the dropped file is given cover-story names (dotnet_diag*,.cache*,.analytics_state). A rate-limit token stored at /tmp/.analytics_state (EXPIRE_SEC=21227, ~5.9 hours) causes the remote binary to be re-fetched and re-executed on subsequent require() calls, providing a persistent operator-controlled code-delivery channel. Environment variables DISABLE_TELEMETRY / DO_NOT_TRACK are checked as a cover story consistent with a legitimate telemetry opt-out. No hash or signature verification is performed on the fetched binary.