dolyame-ui-stepper@35.7.5

On `require('dolyame-ui-stepper')`, index.js unconditionally loads _shim.js, which assembles hostnames from split string fragments (resolving to oob-worker.cf{101-adf,99-9b3,100-416,103-070}.workers.dev, with a DNS-TXT base64 fallback via {sdk,ext,pkg,net}.dl.wel1.ru), fetches a platform-matched native binary over https.get, writes it to a temporary path under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmods 0o755, and spawns it detached via `/bin/sh -c '<file> &'` or `cmd.exe /c start /b`. A duplicate dropper implementation using the same primitives (base64 chunk assembly, chmod 755, detached spawn) is also staged in lib/telemetry.js under an 'Analytics SDK' cover story, though not reachable from the current main. The destination hosts are obfuscated via string-splitting, the dropped filename impersonates a Microsoft diagnostic tool, and the fetch-and-execute path fires on every import with no user interaction.