🛡️ MAL-2026-13587 — dolyame-ui-inputtools

Malicious code in dolyame-ui-inputtools (npm)

Source: amazon-inspector

On require(), index.js loads _bridge.js which assembles per-platform executable URLs from string-split fragments resolving to rotating Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf102-baf, cf99-9b3, cf101-adf) and *.dl.wel1.ru (sdk/ext/pkg/net subdomains), with a DNS TXT covert-channel fallback that reassembles base64 chunks from numbered subdomain TXT records. Downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). No hash or signature verification is performed and the destinations are not publisher infrastructure. The same fetch->write->chmod+x->detached-spawn chain is duplicated in lib/telemetry.js (the package's main export), which frames itself as an 'Analytics SDK / observability' module and obfuscates the child_process require via string concatenation (require("child_"+"process")) and the fs.chmodSync call via fs["chmod"+"Sync"]. The 'ui-inputtools' package name and the telemetry cover story do not match the shipped behavior.