MAL-2026-13589 Malicious code in dolyame-ui-memoizeweak (npm)

On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT covert-channel fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under cover names such as dotnet_diag.exe and.cache_, chmodded 0755, and detach-spawned via cp.spawn('/bin/sh', ['-c', path + ' &'], {detached:true}). Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string fragments to evade static analysis (e.g. ['oob-work','er.cf9','9-9b3.workers.d','ev'].join(''), require('child_'+'process')). A second, redundant dropper path in lib/telemetry.js base64-decodes fetched chunks, writes an 'extension' file, chmods 0755, and spawns /bin/sh on the result under an 'Analytics SDK' framing. No version pinning, no hash or signature verification, no legitimate purpose consistent with the package's declared name.