Malicious code in distributorblock (npm)

The npm package distributorblock was found to contain malicious code in its main entry point (index.js) and a setup.js module. Upon require, the package unconditionally downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and executes it with detached spawning via shell or cmd.exe.\n\nThe malicious setup.js writes the downloaded binary to /var/tmp/.cache_ on POSIX systems or %TEMP%\dotnet_diag_.exe on Windows, sets executable permissions (mode 0755), and spawns it detached with stdio ignored. A /tmp flag file rate-limits repeated execution, and a DO_NOT_TRACK environment variable check gates the behavior.\n\nWhen HTTP retrieval fails, the package implements a covert DNS TXT record fallback, reassembling the payload from base64-encoded chunks served under subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. This DNS-based channel is designed to bypass HTTP egress controls and network monitoring.\n\nThe package's declared purpose ("API client wrappers") is inconsistent with its actual behavior of fetching and executing native binaries at import time. Author metadata is empty, and the naming conventions, detached spawning, and multi-stage retrieval mechanisms are consistent with a trojan dropper designed to evade both sandboxing and network defenses.