bpm-foundation-storage@35.8.1

On require, index.js loads _ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts on the *.workers.dev and *.dl.wel1.ru namespaces (with a DNS TXT-record fallback that base64-decodes concatenated chunks into a binary), writes it to a temp directory under a masquerading name such as dotnet_diag_<hex>.exe on Windows or.cache_<hex> on POSIX, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, destinations are reconstructed at runtime from split substring arrays, and a secondary DNS-over-TXT loader provides resilience against domain blocking. Any consumer that require()s bpm-foundation-storage triggers execution of attacker-controlled code on the installer's host. The package's declared purpose is a storage library; none of the observed behavior is consistent with that purpose.