MAL-2026-13149

Dashboard / Malicious Package / MAL-2026-13149

MAL-2026-13149

Summary: Malicious code in dolyame-ui-constants (npm)

Details: Source: amazon-inspector (55e6fcb5f8524548ac64acbf658f83a4b610700e0201d3ffe225fcd9d34f7ae2) On require of the package, index.js loads _support.js which assembles Cloudflare Workers hostnames via split-string concatenation (`["oob-work","er.cf101-adf.workers.d","ev"].join("")`, plus cf102-baf and cf103-070 variants) with a DNS fallback to *.dl.wel1.ru. It downloads a platform-specific binary, writes it to /tmp or %TEMP% under deceptive names (`.cache_<hex>` on Linux/macOS, `dotnet_diag_<hex>.exe` on Windows to mimic a Microsoft diagnostic tool), chmods it 0755, and spawns it detached via `cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true})` (and `spawn("cmd",...)` on Windows). The payload is unsigned, unpinned, and unverified. Environment variables named `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, and `DO_NOT_TRACK` frame the behavior as telemetry, but the destinations, filename disguises, and execution pattern are dropper mechanics rather than telemetry. A second, larger parallel dropper implementation lives in lib/telemetry.js (base64-decoded buffers, `fs["chmod"+"Sync"]`, split-string `require("child_"+"process")`, `cp.spawn('/bin/sh',['-c',filePath+' &'])`), staged for activation. Installing or requiring this package causes attacker-controlled code to execute on the installer's host.

References: https://www.npmjs.com/package/dolyame-ui-constants/v/35.5.9