MAL-2026-13596 Malicious code in dolyame-ui-progressline (npm)

On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT-record base64 fallback under *.dl.wel1.ru, writes the payload to a temp path with a deceptive name (/var/tmp/.cache* on Unix, %TEMP%\dotnet_diag_*.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe. The main module lib/telemetry.js (styled as a Sentry-like SDK) contains a parallel dropper path that base64-decodes chunks fetched via DNS TXT failover, writes an 'extension' to disk, sets executable permissions, and spawns it detached — giving a second import-time trigger if the shim path fails. Both files obfuscate the host names and sensitive API references by concatenating string fragments (e.g. ["oob-worker.cf10","1-adf.worke","rs.de","v"].join(""), require("child"+"process"), fs["chmod"+"Sync"]) to evade static scanners. The behavior is framed as 'telemetry' with token opt-out env checks but there is no legitimate telemetry function: the sole effect on require is remote binary retrieval and execution on the installer's host.