MAL-2026-13571 Malicious code in dolyame-ui-generateid (npm)

On require() of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev, with a covert DNS TXT-record fallback that reads chunk counts from c.<domain> and base64 payload fragments from N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under disguised names such as.cache<rand> or dotnet_diag_<rand>.exe, chmodded 0755 on POSIX, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start. A second import-reachable dropper path exists in lib/telemetry.js: it decodes base64 chunks into a Buffer, invokes fs["chmod"+"Sync"] with mode 0o755, and calls cp.spawn("/bin/sh", ["-c", filePath+" &"]). Anti-analysis techniques include split-string require("child_"+"process"), split-property fs["chmod"+"Sync"], array-join hostname assembly, and DNS TXT-record staged payload delivery. The package's stated purpose (a UI ID-generation helper / observability SDK) does not require fetching and executing native binaries from anonymous Cloudflare Workers domains.