Threats Tagged 'mal-2026-13177'

The npm package dolyame-ui-radio version 35.2.2 is identified as a malicious dropper disguised as a UI/telemetry package. Upon requiring the package, it downloads a platform-specific binary from obfuscated Cloudflare Workers hostnames and fallback domains, writes the binary to temporary directories with masquerading names, sets executable permissions, and executes it detached from the parent process. The package includes telemetry-related environment variables as a cover story, but its actual behavior is to execute attacker-controlled native code on the host. A second copy of the drop-and-exec logic is also present but not invoked in this version.