MAL-2026-13507 Malicious code in dolyame-ui-inputcolor (npm)

index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners (e.g., ["oob-w","orker",".cf","101-adf.workers.","de","v"].join("")), selects an OS-specific endpoint, and fetches a binary payload over HTTPS from one of four oob-worker.cf10[0-3]-*.workers.dev hosts. On HTTPS failure, it falls back to a DNS-TXT covert channel: it queries chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-concatenates the chunks, and reconstitutes the payload buffer. The bytes are written to /tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. Module names, API names, and hostnames are reconstructed via string concatenation and dynamic property access (require("child_" + "process"), fs["chmod" + "Sync"], os["host" + "name"]) to defeat plain-text matching. The dropper fires on every require() of this package, granting the operator of those hosts arbitrary code execution on any machine that installs or imports it.