MAL-2026-13645 Malicious code in sme-rko-finance-front-operations-penalty (npm)

On require() of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames (oob-worker.cf103-07/cf99-9b3/cf100-416/cf101-adf.workers.dev) from split string arrays, fetch a platform-specific binary from /pkg/package[-arm64|.exe|loader_mac], write it to /var/tmp/.cache<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. A DNS TXT chunked-base64 fallback channel to .dl.wel1.ru is used when HTTPS fails. Obfuscation techniques include string-split concatenation of host names, dynamic require("child_" + "process"), bracket-notation fs["chmod" + "Sync"], and disguised filenames masquerading as system diagnostics (dotnet_diag,.analytics_state,.cache_). Both the auxiliary _runtime.js and the main entrypoint lib/telemetry.js reachable via index.js contain the dropper primitives, ensuring execution on import.