🛡️ MAL-2026-12668 — custom-plugins-request-factory

Malicious code in custom-plugins-request-factory (npm)

Source: amazon-inspector

The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers endpoints (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe. If HTTPS delivery fails, setup.js reassembles a base64-encoded payload from DNS TXT records under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) as a covert-channel fallback, decodes it, writes it to disk, and executes it. Network destinations and the child_process require are assembled at runtime from split string fragments, and the package is framed as an analytics/telemetry SDK. lib/telemetry.js ships a parallel write-chmod-spawn dropper with the same obfuscation pattern. Requiring or installing the package results in execution of an opaque attacker-controlled binary on the host.