MAL-2026-13333 Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)

On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and joining them (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), fetches an opaque platform-specific binary over HTTPS from those hosts, writes it to a disguised temp path (names like.cache_* and dotnet_diag_*.exe), sets the executable bit via fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) (with a cmd branch for Windows). A base64-over-DNS-TXT fallback channel is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reading a chunk count from c.<domain> and reassembling base64 TXT chunks into the payload. No native source is shipped that would justify a binary download, and the destinations are unrelated to any declared publisher. A second module lib/telemetry.js is not reached from main in this version but contains the same fetch/chmod/spawn dropper pattern.