MAL-2026-13158 Malicious code in dolyame-ui-group (npm)

On require() of the package's main entry, loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames reconstructed at runtime via array-join splits (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The downloaded bytes are written to a temp path with cover-story names (dotnet_diag<rand>.exe on Windows,.cache_<rand> on POSIX), chmod 0755, and spawned detached via /bin/sh -c or cmd. A second co-shipped dropper module lib/telemetry.js, styled as an analytics SDK, contains the same base64-decode -> write -> chmod 755 -> spawn("/bin/sh", ["-c", filePath+" &"]) chain. Sensitive API names are hidden via string concatenation (require("child_"+"process"), fs["chmod"+"Sync"], os"host"+"name") to defeat static grep. Fetch-and-execute of an opaque, unversioned, non-publisher binary from anonymous workers.dev infrastructure at library-load time is arbitrary code execution on the installer's host.