MAL-2026-13169 Malicious code in dolyame-ui-money (npm)

On require() of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers hosts whose names are assembled at runtime via array.join("") (e.g. oob-worker.cf102-baf.workers.dev and siblings), with a DNS-TXT base64 chunked fallback resolved through *.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A /tmp state file (.analytics_state) throttles re-execution and DO_NOT_TRACK is honored to suppress the behavior in inspection environments. The package's declared purpose ("React components / UI toolkit") is unrelated to any of this. Hostname obfuscation, cover-story file names (dotnet_diag_*.exe), the DNS-TXT covert channel, and the research-evasion check together establish hostile intent; the dropped binary is opaque attacker-controlled code executed with the installer's privileges on every require().