MAL-2026-13165 Malicious code in dolyame-ui-list (npm)

On require() of dolyame-ui-list, index.js loads vendor.js which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-.workers.dev through cf103-.workers.dev) with a DNS TXT fallback discovery channel under *.dl.wel1.ru. Destination hostnames and API names are obfuscated via array-fragment join("") and dynamic member access (e.g. require("child" + "process"), fs["chmod" + "Sync"]). The fetched bytes are written to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows (a lookalike name imitating a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No version pin, no hash or signature verification, and the hosts are not the publisher's infrastructure. Environment variables DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are checked as a cover story consistent with a telemetry SDK. A second full copy of the same dropper ships as lib/telemetry.js (81 KB) with identical primitives, providing an alternate loader path. The package name resembles the Russian BNPL vendor Dolyame's UI ecosystem but the behavior matches no legitimate use.