MAL-2026-13582 Malicious code in dolyame-ui-inputsearch (npm)

[email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror list of Cloudflare workers.dev endpoints (oob-worker.cf103-070.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev) from string-concatenation-split literals, with a DNS-TXT fallback resolving base64-encoded download data via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded, written to a hidden path (/var/tmp/.cache<hex> on Unix, TEMP/dotnet_diag_<hex>.exe on Windows), chmod 0755 on Unix, then spawned detached via /bin/sh -c or cmd. Endpoints and filenames are split-literal obfuscated and gated behind cover-story flags named analytics_state and DISABLE_TELEMETRY, and the dropped filename impersonates.NET diagnostics tooling. The purpose of the fetched binary is opaque; the delivery mechanism has no hash or signature verification, no pinning, and no publisher-matched host. The purpose (dropper of an anonymous remote binary) is unrelated to the advertised UI input search functionality.