MAL-2026-13500 Malicious code in delivery-ci-dpat (npm)

On require() of delivery-ci-dpat, _platform.js runs setup() at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a hidden path under /tmp or %TEMP%, chmods it 0o755, and spawns it detached via /bin/sh -c '<file> &' or cmd.exe /c start /b. A DNS-TXT covert channel provides a fallback delivery path: dnsChunked() queries c.<domain> under *.dl.wel1.ru for a chunk count, iterates 0..N.<domain> collecting base64-encoded TXT records, reassembles them into a binary buffer, and executes the reconstructed payload the same way. The C2 hostnames and DNS fallback domain are assembled at runtime from split-string fragments (['oob-worker.cf101-adf.worker','s.','dev'].join(''); ['sdk.dl.wel','1.r','u'].join('')) to evade static matching. A filesystem stamp is used for run-once dedup and the behavior is labeled as analytics/telemetry.