dolyame-ui-checkablegroup @35.8.1

Summary

The package presents itself as a UI checkable-group helper but on require executes a dropper. _helpers.js and the main-exported lib/telemetry.js assemble destination hostnames at runtime from split-string arrays (e.g. ["oob-worker.cf1","00-416.work","er","s.dev"].join("") yielding oob-worker.cf100-416.workers.dev , plus cf101-adf and cf103-070 siblings), select a platform-specific endpoint, download an opaque binary via https.get , write it to /tmp or %TEMP% under a spoofed name mimicking a Microsoft diagnostic tool ( dotnet_diag_<hex>.exe , .cache_<hex> ), chmodSync 0755, and spawn it detached via cp.spawn("/bin/sh",["-c", filePath+" &"], {detached:true}) on Unix or cmd.exe /c start /b on Windows. A covert DNS-TXT fallback channel under *.dl.wel1.ru reassembles a base64 payload from numbered subdomains ( c.<domain> for count, <i>.<domain> for chunks). No hash or signature verification is performed. The dropper is duplicated across _helpers.js and the main-exported lib/telemetry.js , ensuring execution on any require of the package. Hostname obfuscation via split-string concatenation, spoofed on-disk names, detached execution, and the DNS-TXT covert channel are consistent with purpose-built malware distributed as a UI-helper lure.

Source: amazon-inspector (ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97)