Malicious code in dolyame-ui-inputsearchtagged (npm)

The npm package dolyame-ui-inputsearchtagged contained embedded malicious code in its init.js file. Upon require of the package, the code selects a platform-specific payload and downloads opaque bytes over HTTPS from rotating Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a fallback covert channel using DNS TXT lookups against domains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) to reassemble a base64-encoded payload.\n\nThe downloaded bytes are written to temporary files (/var/tmp/.cache on Linux or %TEMP%/dotnet_diag_.exe on Windows), made executable (chmod 0755), and spawned detached via spawn("/bin/sh") or spawn("cmd"). The malware uses obfuscation techniques including runtime string construction to evade static analysis, and disguises its activity using environment variable checks (DISABLE_TELEMETRY, DO_NOT_TRACK) and misleading file names as a telemetry cover story.\n\nInstalling or importing the package results in full-host code execution under attacker control. There is no cryptographic pinning or integrity verification of the downloaded payloads, and the destinations are unrelated to any legitimate publisher.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository (MAL-2026-13583).