Malicious code in dolyame-ui-tableinline (npm)

The npm package dolyame-ui-tableinline was found to contain malicious code that achieves full-host remote code execution. Upon requiring the package, index.js loads init.js which fetches platform-specific native binaries from obfuscated Cloudflare Workers mirrors. Hostnames are reconstructed at runtime using string-array.join("") to evade static detection, with a DNS TXT-record fallback to sdk.dl.wel1.ru.\n\nThe downloaded binary is written to a disguised path under /tmp or %TEMP% (e.g., dotnet_diag.exe, .cache_), given execute permissions (chmod 0755 on POSIX), and spawned detached via /bin/sh -c or cmd /c start /b. A TTL marker file is used to rate-limit re-execution. A second dropper mechanism (base64 buffer decoded, chmod 755, spawned via /bin/sh -c) is duplicated in lib/telemetry.js, the declared main module, wrapped in a fake SDK scaffold.\n\nThe attack uses camouflage techniques including opt-out environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and cover-story file names (dotnet_diag_*, .analytics_state) to disguise malicious activity. The unpinned opaque native payloads, anonymous author-controlled hosts, obfuscated destination reconstruction, and detached background execution constitute a complete compromise vector for any machine that installs or imports the package.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.