Malicious code in delivery-ci-codeceptjs (npm)

The npm package delivery-ci-codeceptjs contained malicious code in its main entry point (_helpers.js). Upon require, the package executes a setup routine that downloads opaque native binaries from attacker-controlled Cloudflare Workers subdomains and alternative DNS-TXT fallback infrastructure under *.wel1.ru domains.\n\nThe malicious payload is downloaded without version pinning or cryptographic verification and is written to platform-specific temporary locations: /var/tmp/.cache_ on Unix systems or %TEMP%\\dotnet_diag_.exe on Windows. The binary is then executed with detached spawning via shell commands (/bin/sh -c or cmd /c start /b), allowing it to run independently of the parent process.\n\nThe package advertises a trivial no-op class and ships no native source code, indicating the download mechanism is the sole purpose of the malicious package. The hostname assembly via string fragment joining and DNS-TXT chunked reassembly of base64 payloads were designed to evade static string scanning. Staging paths use hidden dotfile and diagnostic-lookalike naming conventions to blend with normal system activity.\n\nThe incident was identified and credited to the OpenSSF malicious packages project.