Malicious code in specials-mvno-client (npm)

The npm package specials-mvno-client was found to contain malicious code that executes arbitrary binaries during module load. The index.js file requires a bootstrap.js module that fetches platform-specific executables from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev) and *.dl.well1.site subdomains.\n\nThe malicious code writes the fetched binaries to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under disguised filenames (.cache on Unix, dotnet_diag_.exe on Windows), sets executable permissions, and spawns them detached in the background. Host names are assembled dynamically via array.join to defeat string-matching detection.\n\nThe package implements a DNS-TXT fallback channel that resolves TXT records under c. and N. subdomains, concatenating base64-encoded chunks to deliver code when HTTPS is unavailable. The malicious behavior is cloaked with telemetry-shaped naming and comments, and the code honors DISABLE_TELEMETRY, DO_NOT_TRACK, and ANALYTICS_OPT_OUT environment variables to skip execution on scrutinized hosts.\n\nThe incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-7x38-rxfc-7439.