Malicious code in dolyame-ui-overridestyles (npm)

The npm package dolyame-ui-overridestyles was found to contain malicious code designed to execute arbitrary binaries on systems where the package is installed. Upon require(), the package's _compat.js module invokes a setup routine that downloads platform-specific executables from Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback mechanism using domains under wel1.ru.\n\nThe downloaded payloads are written to temporary files with obfuscated names (e.g., dotnet_diag_.exe, .cache_), made executable (chmod 0755 on Unix), and spawned detached via shell commands (/bin/sh -c or cmd.exe). A secondary dropper path exists in lib/telemetry.js that reconstructs executables from base64 buffers and spawns them similarly.\n\nThe malicious code uses string concatenation to obfuscate critical function calls (child_process require, chmodSync, hostnames) to evade static analysis. No cryptographic verification is performed on downloaded payloads. The package's stated purpose (UI style-override library) is inconsistent with its actual behavior.\n\nThe incident was identified and credited to OpenSSF's malicious-packages repository (MAL-2026-13591).