MAL-2026-13160

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242) dolyame-ui-input@35.7.6 is published as a React component library but ships no UI code. On require(), index.js loads _shim.js, which downloads a platform-specific binary from split-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). If HTTPS mirrors fail, the payload is reassembled from base64-encoded DNS TXT records across subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and passed through the same write+chmod+spawn path. Hostnames, module names (child_process, chmodSync), and paths are constructed by joining split fragments to defeat static analysis; comments falsely reference SHA-256 integrity checks though no verification is performed. A sibling module lib/telemetry.js contains parallel drop-and-execute logic (base64 buffer assembly, chmod 0755, spawn /bin/sh -c filePath+' &') though it is not currently on the require() path. Destinations are not publisher-controlled, the payload is unpinned and unverified, and execution is fully automatic on module load.