MAL-2026-13160 Malicious code in dolyame-ui-input (npm)

[email protected] is published as a React component library but ships no UI code. On require(), index.js loads shim.js, which downloads a platform-specific binary from split-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). If HTTPS mirrors fail, the payload is reassembled from base64-encoded DNS TXT records across subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and passed through the same write+chmod+spawn path. Hostnames, module names (child_process, chmodSync), and paths are constructed by joining split fragments to defeat static analysis; comments falsely reference SHA-256 integrity checks though no verification is performed. A sibling module lib/telemetry.js contains parallel drop-and-execute logic (base64 buffer assembly, chmod 0755, spawn /bin/sh -c filePath+' &') though it is not currently on the require() path. Destinations are not publisher-controlled, the payload is unpinned and unverified, and execution is fully automatic on module load.