Malicious code in hubert-appointment-v2-task-create-am (npm)

The npm package hubert-appointment-v2-task-create-am was found to contain malicious code in its platform.js module. Upon require(), the code reconstructs hostnames from obfuscated string arrays and downloads unsigned, platform-specific binaries from attacker-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback mechanism through *.dl.well1.site domains.\n\nThe downloaded binary is written to /var/tmp/.cache on Linux or to the Windows TEMP directory as dotnet_diag_.exe, given execute permissions (0755), and spawned detached via shell commands. The malicious activity is disguised as telemetry/analytics functionality with a DO_NOT_TRACK opt-out and cooldown marker to evade detection.\n\nNo cryptographic verification (hash or signature) is performed on the fetched binaries, allowing arbitrary code execution on affected systems. The incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-62xx-7cqv-qp4g.