MAL-2026-13586 Malicious code in dolyame-ui-inputtime (npm)

On require('dolyame-ui-inputtime'), index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts (oob-worker.cf101-.workers.dev, oob-worker.cf102-.workers.dev, oob-worker.cf103-*.workers.dev), with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): dns.resolveTxt is used to fetch a chunk count and base64-encoded payload chunks that are concatenated and decoded. The fetched bytes are written to /tmp or %TEMP% under masquerade names (.cache<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c '<path> &' or cmd /c start, with.unref() to survive the parent process. Hostnames are reconstructed at runtime from array.join to evade static analysis, and dangerous APIs are resolved via string concatenation (require('child_' + 'process'), fs['chmod' + 'Sync']). The same dropper logic is duplicated in lib/telemetry.js under an SDK_NAME='apm.node' cover. Manifest name and description ('Monitoring and observability SDK') do not match the shipped behavior; the package name has no relation to the code.