dolyame-ui-inputtime@35.8.1

Analysis

dolyame-ui-inputtime@35.8.1 is a multi-stage dropper disguised as a monitoring/observability SDK. On require, index.js loads _loader.js, which fingerprints the platform/arch and downloads a second-stage binary over HTTPS from three Cloudflare Workers endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) at /pkg/package (with platform-specific variants /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If the HTTPS download fails, it falls back to DNS TXT-tunneled exfiltration via c[.]sdk[.]dl[.]wel1[.]ru and related wel1[.]ru domains. The downloaded payload is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe under %TEMP% on Windows), chmod 755, and executed detached via /bin/sh -c or cmd.exe /c start /b, so it outlives the parent process. The bundled lib/telemetry.js is a decoy analytics facade; the real behaviour is remote binary download-and-execute on install.