dolyame-ui-button@35.9.6

Analysis

dolyame-ui-button is a trojanized "React components" package whose index.js immediately loads a bundled bootstrap that downloads and executes a remote binary. On require, _bootstrap.js selects a payload by OS/architecture and fetches it over HTTPS from Cloudflare Workers endpoints oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev (paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If those fail it reconstructs the payload from base64 DNS TXT records of sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru. The downloaded binary is written to /tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and launched as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c '... &' on POSIX). Execution is rate-limited by a filesystem timestamp and can be suppressed by DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars. The package ships no actual UI code; its sole function is the remote binary dropper.