🛡️ MAL-2026-13570 — dolyame-ui-focusstatehoc

Malicious code in dolyame-ui-focusstatehoc (npm)

Source: amazon-inspector

On require of the package's main entry (index.js), _compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary (linux_x64, linux_arm64, darwin, win32.exe) from a shuffled list of obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The binary is written to /tmp or %TEMP% under a disguised name (.cache_<hex> on unix, dotnet_diag_<hex>.exe on Windows), chmod 755, and spawned detached via cp.spawn("/bin/sh", ["-c", filePath + " &"], {detached:true, stdio:"ignore"}).unref(). No version pinning, no hash or signature verification. Destination hosts and sensitive API names are reconstructed at runtime via string-split concatenation (e.g. ["oob-worker.cf100-416.w","orkers.dev"].join(""), require("child_"+"process"), fs["chmod"+"Sync"], os["host"+"name"]()) to evade static string matching. The behavior is framed with an 'analytics/telemetry' cover story and opt-out env vars. lib/telemetry.js additionally assembles a base64-encoded payload (Buffer.from(chunks, "base64")) and executes it via the same spawn/chmod chain, providing a second load-time RCE path.