dolyame-ui-dataqa@35.8.1

Analysis

dolyame-ui-dataqa@35.8.1 is a multi-stage dropper. On require, index.js loads _polyfill.js, which fingerprints the OS/arch and downloads a platform-specific binary from Cloudflare Workers endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS fails it falls back to DNS TXT-based retrieval from c[.]sdk[.]dl[.]wel1[.]ru (and sdk./ext./pkg./net[.]dl[.]wel1[.]ru per-platform). The downloaded payload is written to the temp dir under a randomized name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 755, and launched detached (cmd.exe /c start /b on Windows, /bin/sh -c "&" on Unix) so it runs in the background. The package also ships a large telemetry module (lib/telemetry.js) that collects hostname and posts analytics envelopes to configured hosts.