MAL-2026-13135
Dashboard / Malicious Package / MAL-2026-13135
MAL-2026-13135
Summary: Malicious code in dolyame-ui-avatar (npm)
Details: Source: amazon-inspector (3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e) On package load, index.js requires./_platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with DNS-TXT fallback resolvers under *.dl.wel1.ru (sdk/ext/pkg/net). Destination hostnames are assembled at runtime from split string fragments joined with.join('') to evade static analysis. The fetched payload is written to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A marker file.analytics_state is written to throttle re-execution. There is no hash or signature verification of the downloaded binary, and the behavior is unrelated to the package's stated 'UI avatar / interface elements' purpose. The package name mimics the legitimate dolyame payment SDK ecosystem.
Affected packages
Package
Name: dolyame-ui-avatar
Purl: pkg:npm/dolyame-ui-avatar
Affected ranges
Type: N/A
Events:
