Malicious code in dolyame-ui-inputautocomplete (npm)

The npm package dolyame-ui-inputautocomplete was found to contain malicious code in its bootstrap.js file. Upon require or import, the code selects a platform-specific binary path and downloads an opaque native executable from author-controlled hosts reconstructed at runtime from string-split arrays: oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf101-adf.workers.dev.\n\nThe package implements multiple anti-analysis techniques. A fallback mechanism reassembles a base64 payload from DNS TXT records enumerated under sdk.dl.wel1.ru. Downloaded binaries are written to obfuscated cache paths (/tmp/.cache on Unix or %TEMP%/dotnet_diag_.exe on Windows), marked executable (chmod 0755), and spawned detached via shell commands.\n\nAny process that requires the package immediately executes attacker-controlled native code with the installer's privileges. The string-splitting, diagnostic cache filename masquerading, and DNS-TXT reassembly channel are active anti-analysis techniques rather than legitimate SDK behavior, indicating intentional malicious design.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.