MAL-2026-13190 Malicious code in dolyame-ui-tabs (npm)

index.js requires./support, whose top-level run() fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (reconstructed via array.join() such as ['oob-worker.cf102-baf.','worker','s.','dev']) with a DNS-TXT chunked base64 fallback channel served from *.dl.wel1.ru resolver hosts (e.g. ['sd','k.dl.wel','1.','ru'].join('')). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmod 0755'd on POSIX, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution fires on require() of the package, giving arbitrary remote code execution on the installer's host at library-load time. The package is advertised as a React components/tabs library and has no legitimate need for a native binary or DNS-TXT payload channel. lib/telemetry.js contains a structurally identical dormant dropper (HTTPS + DNS discovery, chunk decoding, chmod 755, /bin/sh spawn) that is not reached from the current entry point but ships in the tarball. Hostname reconstruction, disguised drop filenames, and telemetry-styled opt-out env vars indicate deliberate evasion.