🛡️ MAL-2026-13590 — dolyame-ui-noindex

Malicious code in dolyame-ui-noindex (npm)

Source: amazon-inspector

On require(), index.js loads./_ext which selects a platform-specific payload (linux_x64/arm64, darwin, win32), downloads an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru hosts whose names are reconstructed from split string arrays, writes it to /tmp or the Windows temp directory under a disguised name (a hidden.cache_<hex> file or a dotnet_diag_<hex>.exe lookalike), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-based fallback channel reassembles base64 payload chunks from numbered subdomains of ext.dl.wel1.ru / sdk.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru when HTTPS is blocked. The same drop-and-exec routine is duplicated in lib/telemetry.js, where the child_process require is also split-string obfuscated. The package name resembles a legitimate UI library but the shipped code contains no such library — its only import-time effect is to fetch and execute an opaque remote binary.