MAL-2026-13545 Malicious code in devplatform-spa-errors (npm)

On require() of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary from string-concatenated Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback channel to *.dl.wel1.ru, writes the bytes to a temp path disguised as dotnet_diag<tok>.exe on Windows or.cache_<tok> on POSIX, chmods it to 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. Hostnames and dropped filenames are assembled at runtime from split-string arrays and framed with Analytics/telemetry SDK cover strings. lib/telemetry.js contains a duplicate copy of the dropper logic (base64-decoded chunks, chmodSync 0755, cp.spawn('/bin/sh', ['-c', filePath + ' &'])) inside a decoy Sentry-like observability module. The package delivers attacker-controlled native code to the installer's host on module load, with no integrity verification and active string obfuscation to evade review.