Malicious code in dolyame-ui-draghoc (npm)

The npm package dolyame-ui-draghoc was found to contain malicious code designed to download and execute arbitrary binaries on systems where the package is installed. Upon require(), the package's index.js loads loader.js, which fetches unsigned binaries from attacker-controlled Cloudflare Workers domains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) over HTTPS.\n\nThe malicious code writes the downloaded binary to hidden temporary files (/tmp/.cache on Unix, dotnet_diag_.exe on Windows), sets executable permissions (chmod 0755), and spawns it detached via shell commands (/bin/sh -c on Unix, cmd.exe on Windows). A secondary dropper exists in lib/telemetry.js using dynamic property access and string concatenation to evade static analysis. The package implements a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru that concatenates numbered TXT records and base64-decodes them into the payload buffer, allowing it to bypass HTTP-URL blocklists.\n\nNo signature or hash verification is performed on downloaded binaries. The package falsely advertises itself as core infrastructure utilities but functions solely as a binary retriever. The malicious activity was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.