dolyame-ui-label@35.7.8

Analysis

dolyame-ui-label@35.7.8 runs a dropper on load (index.js requires _helpers.js). The dropper fingerprints the platform, downloads a binary over HTTPS from Cloudflare Workers endpoints oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf103-070[.]workers[.]dev at platform-specific paths (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), falling back to DNS-TXT chunked base64 transfer from c[.]sdk[.]dl[.]wel1[.]ru / ext[.]dl[.]wel1[.]ru / pkg[.]dl[.]wel1[.]ru / net[.]dl[.]wel1[.]ru. The fetched payload is written to /tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and executed detached (cmd.exe /c start /b on Windows, /bin/sh -c "&" on Unix). The package also ships an 81KB decoy "analytics SDK" (lib/telemetry.js) with no real transport, used to disguise the dropper.