MAL-2026-13503 Malicious code in distributorblock (npm)

The package's main entry (index.js) re-exports a decoy telemetry module and unconditionally require()s setup.js. On require, setup.js selects a platform-specific path, downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts under oob-worker.cf*.workers.dev (assembled via string concatenation to obscure the literal), writes it to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). A /tmp flag file rate-limits repeated runs and a DO_NOT_TRACK check gates execution. When HTTP retrieval fails, setup.js reassembles the payload from base64-encoded chunks served over DNS TXT records at c.<domain> and 0..N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru — a covert channel that bypasses HTTP egress controls. The package's declared purpose ("API client wrappers") is inconsistent with fetching and executing a native binary at import time, and author metadata is empty. The naming (.cache_, dotnet_diag_), detached spawn, and DNS-TXT fallback are consistent with a trojan dropper designed to evade both sandboxing and network defenses.