MAL-2026-13171 Malicious code in dolyame-ui-notification (npm)

Package advertises itself as a UI notification toolkit but its main entry require()s./compat.js, which on load randomly selects a destination from four obfuscated Cloudflare workers.dev hosts (oob-worker.cf9-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) reconstructed at runtime from split string arrays, with a DNS-TXT fallback channel over *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) that reassembles base64 fragments from sequential subdomain TXT records. It downloads a platform-specific native binary (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), writes it to /var/tmp/.cache<hex> or %TEMP%\dotnet_diag_<hex>.exe under a cover-story filename, chmods 0755, and spawns it detached via /bin/sh or cmd. The runtime-reconstructed destinations, DNS-TXT covert channel, hidden staging paths with diagnostic-tool-lookalike filenames, and mismatch between the declared UI purpose and the fetch-and-execute behavior identify this as a supply-chain dropper rather than legitimate functionality.