MAL-2026-13532 Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

On require() of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru. The destination hostnames are assembled via array.join('') string-splitting to evade static indicator scanning. The fetched payload is written to /tmp or %TEMP% under a disguised filename (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod'd 0755, and spawned detached via spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',…). There is no hash or signature verification of the downloaded binary; the destinations are not publisher-controlled; opt-out is disguised as a generic DISABLE_TELEMETRY environment variable. The dropper is reachable from the package main entry at import time, so a plain npm install followed by any require() of the package executes attacker-controlled native code on the installer's host.