MAL-2026-13508 Malicious code in dolyame-ui-inputpassword (npm)

On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list of anonymous Cloudflare Workers hosts (oob-worker.cf1{00,01,02,03}-*.workers.dev) with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru (chunk count from c.<domain>, base64 chunks from indexed TXT records reassembled via Buffer.from(…, 'base64')). The fetched bytes are written to a disguised temp path (.cache<hex>/dotnet_diag_<hex>.exe), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Destination hostnames and module names are assembled from split string fragments (e.g. 'oob-worker.cf103-070.wo'+'rkers.d'+'ev', require('child_'+'process'), fs['chmod'+'Sync']) to evade static string search. The package presents itself as a UI input-password wrapper; the dropper behavior is unrelated to that stated purpose and is duplicated across _bootstrap.js and lib/telemetry.js so it fires whether the package is loaded via the main entry or the bootstrap side-effect.