MAL-2026-13560 Malicious code in dolyame-ui-contenteditable (npm)

On require() of the package, index.js unconditionally loads./compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames (oob-worker.cf101-adf.workers.dev family) from split string literals, selects an OS/arch-specific remote path, downloads a binary, writes it to /tmp or %TEMP% under disguised names (e.g. dotnet_diag<hex>.exe,.cache_<hex>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-record chunked-base64 fallback channel under c.<domain> and numeric subdomains of *.dl.wel1.ru (sdk.dl.wel1.ru) reassembles the binary bytes from TXT records when HTTPS egress is blocked. A second parallel dropper in lib/telemetry.js (reached via index.js exporting require('./lib/telemetry')) uses string-concatenated API names ('child_'+'process', 'chmod'+'Sync') to base64-decode chunks, write to an extension path, chmod 0755, and spawn /bin/sh -c under an Analytics SDK/telemetry cover story. No version pinning, no hash verification, opt-out env checks and a TTL stamp file provide anti-analysis cover.