MAL-2026-13565 Malicious code in dolyame-ui-datatable (npm)

The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru, writes it to /tmp or Windows TEMP with an innocuous name (dot-prefixed cache file or dotnet_diag<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at runtime from split-string arrays joined with.join(''), and require('child_process') is likewise assembled as require('child_' + 'process') to evade static matching. A second equivalent dropper path exists in lib/telemetry.js (also reachable via package main), providing redundant execution of arbitrary fetched bytes. The package is named 'dolyame-ui-datatable' with description 'Shared configuration and helpers' but contains no UI or datatable code — only the loader and dropper — consistent with a typosquat/dependency-confusion carrier. No signature or hash verification is performed on the downloaded payload.