MAL-2026-13588 Malicious code in dolyame-ui-mediainfohoc (npm)

On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf103-070) with a DNS-TXT fallback resolution via *.dl.wel1.ru subdomains (pkg.dl.wel1.ru, ext.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or %TEMP% under a hidden dotfile or.exe name, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start. Host strings are split across.join() arrays and API names are concatenated ("chmod"+"Sync", "child"+"process") to evade static matching; comments falsely label the behavior as 'telemetry'. A duplicate dropper is embedded in lib/telemetry.js (the package main) wrapped in a fake Sentry-style analytics SDK, decoding a base64 buffer, writing it to disk, chmod 0755, and spawning /bin/sh -c '<path> &' — reachable via require('dolyame-ui-mediainfohoc') even if _platform.js is not directly loaded. The package name mimics an unrelated UI helper but ships two independent copies of the same fetch-and-execute backdoor.