MAL-2026-13527 Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

On require() of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments (require("child"+"process"), array-join of hostname fragments), fetches a platform-specific binary payload via https.get from Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to a temp path under a disguised filename, chmods 0755, and spawns it detached via cp.spawn('/bin/sh',['-c', filePath+' &'],{detached:true}). No version pinning, no hash/signature verification, and destinations are unrelated to the package's advertised purpose. lib/telemetry.js contains a dormant second copy of the same drop-and-spawn shape (base64 chunk decoding, chmod 0755, detached /bin/sh spawn), currently unreachable from index.js. The 'analytics' framing and split-string obfuscation of both the child_process import and the hostnames are cover-story evasion of static analysis.