MAL-2026-13275 Malicious code in devplatform-zod-wip-api (npm)

[email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./vendor on load; vendor.js runs at module load, reassembles a C2 hostname from split string fragments (oob-worker.cf99-9b3.workers.dev) with a DNS-TXT-record fallback to sdk.dl.wel1.ru, fetches a platform-specific native binary over HTTPS, writes it to /var/tmp/.cache<uid> on Unix or %TEMP%\dotnet_diag<uid>.exe on Windows, chmods it 0755, and detached-spawns it via /bin/sh -c "<path> &" or cmd start /b. There is no signature or hash verification of the fetched bytes. A marker file at.analytics_state/analytics_state gates re-execution to roughly a 6-hour interval. A second parallel dropper implementation is shipped in lib/telemetry.js (assembles base64 chunks over DNS TXT, writes an 'extension' file, chmods 755, spawns /bin/sh). Hostname reassembly via.join(''), split-string obfuscation of DNS resolvers, and hidden filenames masquerading as OS cache/diagnostics files (.cache_, dotnet_diag_) indicate deliberate evasion rather than telemetry. On any require() of this package, arbitrary attacker-controlled native code executes on the installer's host.