MAL-2026-13136

    Dashboard / Malicious Package / MAL-2026-13136

    MAL-2026-13136

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-badge (npm)

    Details: Source: amazon-inspector (11c1280f596630bc692c2587a15a33bd01b2b745875cfe8a590e6787757867dd) On require() of dolyame-ui-badge, the package loads _bootstrap.js which downloads a native binary from runtime-assembled Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS TXT-record fallback channel over *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe and.cache_*, chmods it to 0o755, and spawns it detached via /bin/sh -c or cmd.exe /c start. Destination hostnames are obfuscated by splitting them across array elements and reconstructing at runtime via.join(""). Cover-story comments referencing SHA-256 verification, opt-out flags, and rate-limiting do not correspond to matching code. The package advertises itself as a UI badge component and has no build-time or functional need for a native binary. No signature or hash verification is performed on the downloaded payload.

    References: https://www.npmjs.com/package/dolyame-ui-badge/v/35.4.4

    Affected packages

    Package

    Name: dolyame-ui-badge

    Purl: pkg:npm/dolyame-ui-badge

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.4.4
    MAL-2026-13136 | CVE-DB