Malicious code in dolyame-ui-postcsscustomproperties (npm)

The npm package dolyame-ui-postcsscustomproperties was identified as containing malicious code designed to execute arbitrary binaries on infected systems. Upon require() of the package, the malicious code in _shim.js and lib/telemetry.js selects a platform-specific payload and attempts to download a binary over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev).

If the primary download fails, the malware falls back to reassembling base64-encoded chunks retrieved via DNS TXT queries against *.sdk.dl.wel1.ru. The fetched binary is written to /var/tmp/.cache_ on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, given execute permissions (chmod 0755), and executed via /bin/sh -c or cmd.exe.

The package name is a typosquat of the legitimate postcss-custom-properties package, and the malicious code is obfuscated by string-splitting and runtime reassembly of sensitive identifiers (e.g., "child_"+"process", fs["chmod"+"Sync"]) to evade static analysis. The malware is labeled as an 'Analytics SDK' or 'telemetry' module to appear legitimate.

This incident was identified and credited to the OpenSSF malicious-packages repository.