MAL-2026-13494 Malicious code in bigops-telephony-mock (npm)

Requiring the package (index.js ->./setup) triggers setup.js, which reconstructs destination hostnames from split string fragments (e.g. oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, downloads a platform-specific binary via https.get, writes it to a disguised path under /tmp or %TEMP% (names such as analytics_state, dotnet_diag_.exe,.cache_), fs.chmodSync's it to 0755, and cp.spawn's it detached via /bin/sh -c '<file> &' or cmd.exe /c start /b. No version pin, no hash or signature verification, and destinations are assembled at runtime to defeat static inspection; child_process itself is required as "child_" + "process" in lib/telemetry.js. A second copy of the same download->base64-decode->chmod 755->spawn /bin/sh loader is bundled under lib/telemetry.js (approximately 81KB) framed as a telemetry SDK. The behavior fires on any require()/import of the package, gated only by an opt-out env var and a TTL marker file, so a normal npm install followed by loading the module causes attacker-controlled code to execute on the installer's machine.