MAL-2026-13496 Malicious code in ded-pwa-c-cms (npm)

On require('ded-pwa-c-cms'), index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from obfuscated author-controlled hosts (Cloudflare Workers subdomains such as oob-worker.cf*-*.workers.dev and *.dl.wel1.ru subdomains including sdk/ext/pkg/net), with a DNS-TXT chunked base64 fallback channel (count read from c.<domain>, chunks read from i.<domain>). The fetched bytes are written to /tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or the cmd equivalent). C2 hostnames are reassembled at runtime from split-string arrays joined with.join(''), and execution is gated behind DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks as a telemetry cover story. The package advertises itself as a pluggable CMS interface with no dependencies and no legitimate need for a native binary; the dotnet_diag filename masquerades as a Microsoft diagnostic tool. No hash/signature verification is performed on the fetched payload.