MAL-2026-13600 Malicious code in dolyame-ui-tableinline (npm)

On require('dolyame-ui-tableinline'), index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors (hostnames reconstructed at runtime via string-array.join("") to evade static matching), with a DNS TXT-record fallback to sdk.dl.wel1.ru. The binary is written to a disguised path under /tmp or %TEMP% (e.g., dotnet_diag<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c "<path> &" or cmd /c start /b. A TTL marker file rate-limits re-execution. A second dropper (base64 buffer -> chmod 755 -> /bin/sh -c spawn) is duplicated inside lib/telemetry.js, the declared main module, wrapped in a fake SDK scaffold. Opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and cover-story file names (dotnet_diag_*,.analytics_state) are used as camouflage. The unpinned opaque native payloads, anonymous author-controlled hosts, obfuscated destination reconstruction, and detached background execution constitute full-host remote code execution on any machine that installs or imports the package.