dolyame-ui-form@20.1.7

Analysis

dolyame-ui-form@20.1.7 is a trojanized package that downloads and executes a remote binary payload. On require(), _bootstrap.js contacts Cloudflare Workers C2 infrastructure (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS to download a platform-specific binary. It falls back to DNS TXT-record-based retrieval from domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded payload is written to /var/tmp/.cache_<hex> (Linux) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process. The package has no repository, no lifecycle scripts, and no meaningful documentation — the payload runs silently on import.