MAL-2026-13177 Malicious code in dolyame-ui-radio (npm)

[email protected] is a dropper disguised as a UI/telemetry package. index.js unconditionally require()s./adapter.js, which on module load downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under masquerading names (dotnet_diag<hex>.exe on Windows,.cache_<hex> on Unix), chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Destination hostnames are assembled from split-and-joined string fragments; cache paths and opt-out env-var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK,.analytics_state) present a telemetry cover story that does not match the observed drop-and-exec behavior. A second copy of the same drop-and-exec logic (base64 chunk assembly, chmodSync 0755, spawn /bin/sh) is bundled in lib/telemetry.js, unreached in this version's import graph but shipped in the tarball. Any require() or import of this package executes attacker-controlled native code on the installer's host.