Malicious code in dolyame-ui-controlgroup (npm)

The npm package dolyame-ui-controlgroup was found to contain malicious code that executes on module import. The _compat.js file selects a per-OS/arch URL and downloads a native binary from obfuscated hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-over-TXT fallback under sdk.dl.wel1.ru. The downloaded binary is written to a temporary file with a hidden/randomized name resembling dotnet-diag, made executable, and spawned detached via shell commands.\n\nThe malicious functionality is duplicated in the declared main module lib/telemetry.js, which base64-decodes a buffer, writes it to disk, makes it executable, and spawns it via shell. This ensures the payload executes even if the _compat require is removed. Hostnames and dangerous API identifiers (child_process, chmodSync) are assembled at runtime using .join("") and dynamic property access to evade string-based detection.\n\nThe download hosts, endpoints, and destination filenames are unrelated to the package's advertised monitoring/observability purpose, indicating intentional malicious activity. The incident was identified by the OpenSSF malicious-packages project.