MAL-2026-13567 Malicious code in dolyame-ui-draghoc (npm)

On require(), index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled at runtime via array joins (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), writes it to a hidden temp file (/tmp/.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. A DNS-TXT covert-channel fallback under sdk.dl.wel1.ru concatenates numbered TXT records and base64-decodes them into the payload buffer to bypass HTTP-URL blocklists. A parallel dropper exists in lib/telemetry.js reachable from the package's main entry, using dynamic property access (fs['chmod'+'Sync'], require('child_'+'process')) as anti-analysis obfuscation and following the same fetch->chmod->detached spawn pattern. No signature or hash verification is performed on the downloaded binary. The package advertises itself as core infrastructure utilities but ships only a binary retriever.