MAL-2026-13498 Malicious code in ded-pwa-ded-pwa-core (npm)

On require('ded-pwa-ded-pwa-core'), index.js unconditionally loads adapter.js, which selects a platform-specific target path (%TEMP%/dotnet_diag<hex>.exe on Windows, /tmp/.cache_<hex> on POSIX), fetches an opaque binary over HTTPS from author-controlled Cloudflare Workers endpoints, writes it to disk, chmods 0755, and detached-spawns it via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or cmd. The destination hostnames are reconstructed at runtime from split-string arrays (e.g. ['oob-worker.cf100-416.workers.','dev'].join('') and ['sdk.','dl','.wel1','.r','u'].join('') yielding sdk.dl.wel1.ru) to evade static grepping, and identifier lookups such as require('child_'+'process') and fs['chmod'+'Sync'] are similarly split. A DNS-TXT chunked-base64 fallback via *.dl.wel1.ru is present. Staged filenames masquerade as.NET diagnostics tooling or hidden cache files, and DO_NOT_TRACK / ANALYTICS_OPT_OUT env checks provide a telemetry cover story despite the executed content being an opaque author-controlled binary with no version pinning and no hash verification. Installing or requiring the package results in arbitrary code execution on the installer's host.