MAL-2026-13599 Malicious code in dolyame-ui-sortablelist (npm)

On require() the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf10{0..3}-*.workers.dev, host strings assembled by joining split literals to evade static analysis), with a fallback that reassembles a base64 payload from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The binary is written to a temp file disguised as OS diagnostics output ('dotnet_diag_<hex>.exe' on Windows, '.cache_<hex>' elsewhere), chmod'd 0755, and spawned detached and unref'd via cp.spawn('/bin/sh', ['-c', filePath+' &']). The same drop-and-exec logic is duplicated in lib/telemetry.js (the package's declared main), ensuring execution even if bridge.js is bypassed. child_process is imported via string concatenation (require('child'+'process')) and fs.chmodSync via bracket-access to further evade pattern scanning. The module self-labels as 'telemetry/analytics' and gates the drop on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables as a plausible-deniability cover; the actual behavior is fetch-and-execute of an attacker-controlled binary on the installer's host at import time.