MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) and fetches a platform-specific native binary via https.get. The payload is written to /var/tmp or %TEMP% under a masqueraded name (.cache, dotnet_diag_.exe), chmod'd 0o755, and spawned detached via spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd',…). A secondary DNS-TXT covert channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru serves base64-chunked payload as fallback (c.<domain> yields chunk count, i.<domain> returns base64 chunks decoded with Buffer.from(…,'base64')). Execution is gated by a filesystem stamp and env vars framed as telemetry opt-outs. The package is advertised as data-store bindings and has no legitimate need to fetch and execute a native binary from anonymous workers.dev hosts at require time.