MAL-2026-13133

    Dashboard / Malicious Package / MAL-2026-13133

    MAL-2026-13133

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-accordion (npm)

    Details: Source: amazon-inspector (9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637) The package is advertised as a React accordion UI component but on require() unconditionally loads _vendor.js, which downloads a platform-specific binary from obfuscated Cloudflare workers.dev endpoints (with a DNS TXT-record base64 fallback via *.wel1.ru), writes it to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime from split string fragments (e.g. ["oob-worker.cf99-9b3.workers",".dev"].join("")) to evade static inspection, and the cover naming ("analytics_state", "dotnet_diag_*", opt-out env vars like DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the flow as diagnostics. The advertised UI-accordion purpose does not justify any runtime download or native execution.

    References: https://www.npmjs.com/package/dolyame-ui-accordion/v/35.2.6

    Affected packages

    Package

    Name: dolyame-ui-accordion

    Purl: pkg:npm/dolyame-ui-accordion

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.6
    MAL-2026-13133 | CVE-DB