MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

On require(), shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via array-join to evade static inspection. The payload is written to /tmp or %TEMP% under a disguised name (.cache<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c or cmd. If HTTPS fetches fail, the loader falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, retrieving a chunk count from c.<domain> and reassembling a base64-encoded binary from sequentially-numbered subdomain TXT records. index.js requires _shim on load, so importing the package auto-executes the fetched attacker-controlled native binary with no version pinning, no hash or signature verification, and destinations unrelated to the package's stated purpose. A 21028-second cache stamp gates repeats and undocumented environment variables provide an operator opt-out, both consistent with hostile dropper tradecraft rather than legitimate functionality.