Malicious code in dolyame-ui-inputpassword (npm)

The npm package dolyame-ui-inputpassword contained embedded malicious code designed to download and execute platform-specific binaries. Upon package installation and require, the index.js file loads lib/telemetry.js and bootstrap.js, which together fetch binaries from a rotating list of Cloudflare Workers hosts (oob-worker.cf1{00,01,02,03}-*.workers.dev) with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru.\n\nThe fetched binary is written to a disguised temporary path (.cache/dotnet_diag_.exe), given execute permissions (0755), and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start). The malicious code uses string fragmentation and obfuscation techniques to evade static analysis, splitting hostnames and module names across multiple string concatenations (e.g., 'oob-worker.cf103-070.wo'+'rkers.d'+'ev').\n\nThe package presented itself as a legitimate UI input-password component, but the dropper behavior was unrelated to its stated purpose. The malicious code was duplicated across both _bootstrap.js and lib/telemetry.js to ensure execution regardless of how the package was loaded.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.