Malicious code in dolyame-ui-mediainfohoc (npm)

The npm package dolyame-ui-mediainfohoc was published with embedded malicious code designed to fetch and execute arbitrary binaries. The package name mimics an unrelated UI helper library but contains two independent copies of the same fetch-and-execute backdoor.

Upon require, the package's _platform.js module selects a platform-specific asset and downloads an opaque binary from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf103-070). If those fail, it attempts DNS-TXT fallback resolution via *.dl.wel1.ru subdomains (pkg.dl.wel1.ru, ext.dl.wel1.ru, net.dl.wel1.ru). The downloaded binary is written to /tmp or %TEMP% under a hidden dotfile or .exe name, given execute permissions (chmod 0755), and spawned detached via shell commands.

A duplicate dropper is embedded in lib/telemetry.js (the package main entry point), wrapped in a fake Sentry-style analytics SDK. This variant decodes a base64 buffer, writes it to disk, chmods it 0755, and spawns it via /bin/sh -c or cmd.exe. The backdoor is reachable via require('dolyame-ui-mediainfohoc') even if platform.js is not directly loaded. Obfuscation techniques include splitting host strings across .join() arrays and concatenating API names ("chmod"+"Sync", "child"+"process") to evade static matching, with false comments labeling the behavior as 'telemetry'.