MAL-2026-13137
Dashboard / Malicious Package / MAL-2026-13137
MAL-2026-13137
Summary: Malicious code in dolyame-ui-block (npm)
Details: Source: amazon-inspector (7d0fed433faae413825a41330dcf81ec06db856008fdf7ebb4cd3e385626b4ce) On require of the package's main entry (index.js), _adapter.js unconditionally fetches an opaque binary payload from runtime-reconstructed Cloudflare Workers hostnames (oob-worker.cf1{00-03}-*.workers.dev) with a DNS-TXT-based fallback loader under *.dl.wel1.ru. The payload is written to a hidden path in /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), marked executable with chmod 0755, and launched via a detached spawn of /bin/sh -c or cmd. No hash or signature verification is performed. Endpoint hostnames are assembled via array split/join to evade static string matching, and a DNS-TXT channel reads a base64-encoded payload split across numbered TXT records at 0..N.<resolver-domain>. Re-execution is gated by a timestamp file at /tmp/.analytics_state. The behavior has no relationship to a UI-components package and matches an install/import-time remote code execution dropper with deliberate obfuscation and evasion.
Affected packages
Package
Name: dolyame-ui-block
Purl: pkg:npm/dolyame-ui-block
Affected ranges
Type: N/A
Events:
