Malicious code in dolyame-ui-datatable (npm)

The npm package dolyame-ui-datatable was identified as containing malicious code designed to download and execute arbitrary binaries on affected systems. The package's main entry point requires _platform.js, which on load fetches platform-specific binaries from anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru.

The downloaded payload is written to temporary directories (/tmp on Unix or Windows TEMP) with innocuous names (dot-prefixed cache files or dotnet_diag_.exe), given executable permissions (0755), and spawned detached via /bin/sh -c or cmd. A second equivalent dropper path exists in lib/telemetry.js, providing redundant execution capability.

The package is named 'dolyame-ui-datatable' with description 'Shared configuration and helpers' but contains no actual UI or datatable code—only the loader and dropper—consistent with a typosquat or dependency-confusion attack. Obfuscation techniques include runtime reconstruction of destination hostnames from split-string arrays and assembly of require('child_process') as require('child_' + 'process') to evade static analysis. No signature or hash verification is performed on downloaded payloads.

The incident was identified by the OpenSSF malicious-packages project and reported via Amazon Inspector.