MAL-2026-13149 Malicious code in dolyame-ui-constants (npm)

On require of the package, index.js loads _support.js which assembles Cloudflare Workers hostnames via split-string concatenation (["oob-work","er.cf101-adf.workers.d","ev"].join(""), plus cf102-baf and cf103-070 variants) with a DNS fallback to *.dl.wel1.ru. It downloads a platform-specific binary, writes it to /tmp or %TEMP% under deceptive names (.cache_<hex> on Linux/macOS, dotnet_diag_<hex>.exe on Windows to mimic a Microsoft diagnostic tool), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}) (and spawn("cmd",...) on Windows). The payload is unsigned, unpinned, and unverified. Environment variables named DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK frame the behavior as telemetry, but the destinations, filename disguises, and execution pattern are dropper mechanics rather than telemetry. A second, larger parallel dropper implementation lives in lib/telemetry.js (base64-decoded buffers, fs["chmod"+"Sync"], split-string require("child_"+"process"), cp.spawn('/bin/sh',['-c',filePath+' &'])), staged for activation. Installing or requiring this package causes attacker-controlled code to execute on the installer's host.