MAL-2026-13591 Malicious code in dolyame-ui-overridestyles (npm)

On require() of the package, _compat.js invokes a setup() routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked-base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a cover-named file under TMP or /var/tmp (e.g., dotnet_diag_.exe,.cache_), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. A second dropper path in lib/telemetry.js (loaded via the package main) reconstructs an executable from base64 buffers, chmods 0755, and spawns via /bin/sh. Hostnames, the child_process require, and chmodSync are constructed by concatenation to evade static scanners. No hash or signature verification is performed on the downloaded payloads. The purpose is inconsistent with the package's presented name (a UI style-override library).