MAL-2026-13316 Malicious code in dolyame-boxy-independent-bnpl-documents (npm)

On require() of the package's main index.js, bridge.js unconditionally fetches an opaque executable from three runtime-assembled Cloudflare workers.dev hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /tmp/.cache<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0o755, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Host strings are reassembled from arrays via.join("") to hide them from string scans; execution is gated by a /tmp stamp TTL and skipped when DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are set; the dropped filenames mimic OS artifacts. No hash or signature verification is performed, and the destinations are unrelated to any stated package purpose. A sibling module lib/telemetry.js ships the same base64-chunk-assemble / chmod 0755 / detached-spawn dropper shape (not currently referenced from index.js in this version but present in the tarball).