MAL-2026-13566

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226) On require(), dolyame-ui-deprecatepropshoc@35.8.1 side-effect-loads _adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments (['oob-worker.cf101-adf.','wor','kers.dev'].join('')) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, fetch a platform-specific opaque binary (/pkg/package, /pkg/loader_mac, /pkg/package.exe), write it to /var/tmp/.cache_<uid> or %TEMP%\dotnet_diag_<uid>.exe, apply mode 0755 via fs['chmod'+'Sync'], and spawn it detached through /bin/sh -c or cmd.exe /c start /b. child_process is loaded via require('child_'+'process') to evade static matching. There is no version pin, hash, or signature verification on the fetched executable. The dropper is duplicated inside lib/telemetry.js — the module referenced by index.js's module.exports — so the payload deploys even if _adapter.js is removed. The 'telemetry'/'analytics_state'/'dotnet_diag_' naming is a cover story; the behavior is remote-code execution on the installer at require() time.