MAL-2026-13188 Malicious code in dolyame-ui-swiper (npm)

On require() of the package's main entry, bridge.js unconditionally runs an init() routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, writes it under /tmp or %TEMP% with a disguised name (.cache<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Destination hostnames and the child_process identifier are assembled at runtime by joining string fragments to evade static inspection. The package is advertised as a UI component library; the fetched binary has no relationship to that stated purpose, is hosted on anonymous edge-worker infrastructure, is unpinned and unverified, and is executed with the privileges of the installing process. Requiring or installing the package results in arbitrary remote code execution on the installer's host.