MAL-2026-13597 Malicious code in dolyame-ui-scrollblock (npm)

On require() of the package, index.js loads helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments (['oob-worker.cf100','-416.work','ers','.de','v'].join('')) and download a platform-specific binary via https.get. The payload is written to /tmp under a hidden dot-file name (or to Windows Temp as dotnet_diag*.exe), chmod'd 0755 via fs['chmod'+'Sync'], and spawned detached with cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}) or the cmd.exe equivalent. A secondary delivery path resolves DNS TXT records under *.dl.wel1.ru (c.<domain> for chunk count, N.<domain> for each chunk), concatenates the base64 payload, and executes it the same way. Sensitive API names (child_process, chmodSync) and destination hostnames are split-string-obfuscated to evade static analysis. The 'Analytics SDK' framing in lib/telemetry.js duplicates the same fetch-write-chmod-exec chain. Installing and importing the package fetches and runs opaque attacker-controlled native code on the developer's machine with no pinning or signature verification.