MAL-2026-13185 Malicious code in dolyame-ui-stepper (npm)

On require('dolyame-ui-stepper'), index.js unconditionally loads shim.js, which assembles hostnames from split string fragments (resolving to oob-worker.cf{101-adf,99-9b3,100-416,103-070}.workers.dev, with a DNS-TXT base64 fallback via {sdk,ext,pkg,net}.dl.wel1.ru), fetches a platform-matched native binary over https.get, writes it to a temporary path under a disguised name (dotnet_diag<hex>.exe on Windows,.cache_<hex> on POSIX), chmods 0o755, and spawns it detached via /bin/sh -c '<file> &' or cmd.exe /c start /b. A duplicate dropper implementation using the same primitives (base64 chunk assembly, chmod 755, detached spawn) is also staged in lib/telemetry.js under an 'Analytics SDK' cover story, though not reachable from the current main. The destination hosts are obfuscated via string-splitting, the dropped filename impersonates a Microsoft diagnostic tool, and the fetch-and-execute path fires on every import with no user interaction.