dolyame-ui-carousel@35.3.3

Analysis

On require(), dolyame-ui-carousel@35.3.3 downloads a platform-specific binary over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker[.]cf102-baf[.]work, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev), with a DNS-TXT fallback channel via *.dl[.]wel1[.]ru domains. The downloaded payload is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe on Windows), made executable, and launched detached via cmd.exe /c start /b or /bin/sh -c '<path> &'. A stamp file at /tmp/.analytics_state (or %TEMP%\analytics_state) throttles re-execution. The package's index.js triggers this dropper automatically whenever the module is required.