Malicious code in dolyame-ui-inputsearch (npm)

dolyame-ui-inputsearch@35.8.1 is a malicious npm package that functions as a dropper for unauthorized remote binaries. Upon require, the package loads a vendor module that assembles a list of Cloudflare Workers endpoints and DNS-TXT fallback domains to retrieve platform-specific executables.\n\nThe malicious behavior includes downloading binaries from multiple domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) and writing them to hidden system paths: /var/tmp/.cache_ on Unix systems and TEMP/dotnet_diag_.exe on Windows. The dropped files are made executable and spawned detached via shell commands. The delivery mechanism lacks hash verification, signature validation, or host pinning.\n\nThe package obfuscates its malicious functionality behind string-literal splitting and cover-story flags named analytics_state and DISABLE_TELEMETRY. The dropped binary filename impersonates .NET diagnostics tooling to evade detection. The purpose of the fetched binary remains undisclosed, but the delivery mechanism is clearly unrelated to the advertised UI input search functionality.\n\nThis incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-9gfm-g4gc-wpmm.