dolyame-ui-money@35.6.1

Analysis

dolyame-ui-money (advertised as "React components") executes a remote binary download-and-run payload the moment the module is required. On load it contacts a rotated set of Cloudflare Workers hosts (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) over HTTPS and fetches a platform-specific binary from /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If those fail it reassembles a second-stage payload from base64 chunks served via DNS TXT records under sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru. The downloaded payload is written to a temp file (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), made executable, and launched as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "file &" on Unix). It suppresses itself when DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK is set.