MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

The package presents itself as a UI checkable-group helper but on require executes a dropper. _helpers.js and the main-exported lib/telemetry.js assemble destination hostnames at runtime from split-string arrays (e.g. ["oob-worker.cf1","00-416.work","er","s.dev"].join("") yielding oob-worker.cf100-416.workers.dev, plus cf101-adf and cf103-070 siblings), select a platform-specific endpoint, download an opaque binary via https.get, write it to /tmp or %TEMP% under a spoofed name mimicking a Microsoft diagnostic tool (dotnet_diag_<hex>.exe, .cache_<hex>), chmodSync 0755, and spawn it detached via cp.spawn("/bin/sh",["-c", filePath+" &"], {detached:true}) on Unix or cmd.exe /c start /b on Windows. A covert DNS-TXT fallback channel under *.dl.wel1.ru reassembles a base64 payload from numbered subdomains (c.<domain> for count, <i>.<domain> for chunks). No hash or signature verification is performed. The dropper is duplicated across _helpers.js and the main-exported lib/telemetry.js, ensuring execution on any require of the package. Hostname obfuscation via split-string concatenation, spoofed on-disk names, detached execution, and the DNS-TXT covert channel are consistent with purpose-built malware distributed as a UI-helper lure.