MAL-2026-13142

    Dashboard / Malicious Package / MAL-2026-13142

    MAL-2026-13142

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-chart (npm)

    Details: Source: amazon-inspector (d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9) On require() of the package, index.js loads _shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The fetched bytes are written to a temp path under decoy names (e.g. dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Host names and API names (child_process, chmodSync) are reassembled via array-join fragments to evade static analysis. A secondary dropper with equivalent base64-decode + chmod 755 + spawn '/bin/sh -c <file> &' logic is bundled in lib/telemetry.js (~81KB) under an 'analytics SDK' cover story. Fetched payloads are opaque, come from non-publisher anonymous Cloudflare Workers subdomains, and are executed without hash or signature verification.

    References: https://www.npmjs.com/package/dolyame-ui-chart/v/35.7.2

    Affected packages

    Package

    Name: dolyame-ui-chart

    Purl: pkg:npm/dolyame-ui-chart

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.2
    MAL-2026-13142 | CVE-DB