devplatform-ui-kit@35.6.2

Package advertised as a UI toolkit but on module load (index.js require()s _adapter.js) fetches an opaque platform-specific binary from obfuscated *.workers.dev hosts, with a DNS-TXT covert-channel fallback that reassembles base64 chunks from subdomains under dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). Host strings are constructed at runtime by joining short fragments (e.g. ["oob-work","er.cf102-baf.workers.de","v"].join("")) to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under disguise names such as dotnet_diag_*.exe /.cache_*, chmodded 0755 on POSIX, and spawned detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}).unref() (cmd on Windows). No hash or signature verification. Behavior fires on any require()/import of the package, executing attacker-controlled code on the installer's machine.