MAL-2026-13139 Malicious code in dolyame-ui-button (npm)

Package advertises itself as a React UI button but its index.js unconditionally requires bootstrap.js on module load. bootstrap.js downloads a platform-specific binary from string-array-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev and siblings), writes it to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag<hex>.exe on Windows), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If the HTTPS fetch fails, the bootstrap falls back to a DNS-over-TXT covert channel against *.dl.wel1.ru: it queries a chunk count from c.<domain>, batches per-chunk TXT queries at 0.<domain>..N.<domain>, base64-concatenates the responses, and writes and executes the resulting binary. C2 hostnames are reassembled at runtime from split-and-join arrays, and cover-story comments ("Shuffle endpoints to distribute load", "SHA-256 integrity check") accompany code that performs no integrity verification. The behavior is unrelated to any UI component functionality and grants the publisher arbitrary code execution on any host that imports the package.