MAL-2026-13598 Malicious code in dolyame-ui-selectaccount (npm)

On require() of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute dropper. The code selects a platform-tagged asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and fetches it from string-split, obfuscated hostnames of the form oob-worker.cf1XX-XXX.workers.dev, with a DNS-TXT chunked-base64 fallback over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under disguised names (.cache<rand> or dotnet_diag_<rand>.exe), chmodded to 0755 via fs["chmod"+"Sync"], and spawned detached with stdio ignored via cp.spawn("/bin/sh", ["-c", filePath + " &"], { detached: true, stdio: "ignore" }).unref() or cmd.exe /c start /b. Dangerous API names are assembled at runtime by string concatenation (require("child_" + "process")) and the destination hostnames are reconstructed with Array.join to hide the C2 from static inspection. The 'Analytics SDK' / 'telemetry' framing does not correspond to the code's actual behavior, which is unconditional retrieval and execution of an attacker-controlled native binary on the installer's host at import time. No integrity check, pinning, or signature verification is performed on the downloaded payload.