🛡️ MAL-2026-13602 — dolyame-ui-tabslayout

Malicious code in dolyame-ui-tabslayout (npm)

Source: amazon-inspector

On require of the package, index.js loads lib/telemetry.js and _polyfill.js, both of which contain dropper logic that selects an OS-specific path, fetches a binary from one of three obfuscated Cloudflare Workers URLs (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-over-DNS-TXT fallback from *.dl.wel1.ru, writes the payload to a temp path under cover names such as dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames and dangerous API references are assembled at runtime by string-splitting concatenation (e.g. ['oob-worker.cf102-baf','.worke','rs.dev'].join(''), require('child_' + 'process'), fs['chmod'+'Sync']) to evade static scanners. The package presents itself as build/deployment tooling and wraps the dropper inside a fake Sentry-style analytics SDK.