MAL-2026-13155

    Dashboard / Malicious Package / MAL-2026-13155

    MAL-2026-13155

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-flag (npm)

    Details: Source: amazon-inspector (be48c86f2b67912c3cfa1849431e5eb3d45510c55bb1fa98ab304dc36d25097b) On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS-TXT chunked base64 fallback resolved via sdk.dl.wel1.ru, writes it to /tmp or the Windows Temp directory under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods 755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. Destination hostnames and dangerous APIs are assembled by array-join and string concatenation (e.g. require("child_"+"process"), fs["chmod"+"Sync"]) to hinder pattern-matching. A second, structurally identical dropper is shipped in lib/telemetry.js under an 'Analytics SDK' label, providing a backup payload vector. The advertised purpose (a UI flag component) has no relationship to fetching and executing opaque native binaries from anonymous Workers hosts.

    References: https://www.npmjs.com/package/dolyame-ui-flag/v/35.7.6

    Affected packages

    Package

    Name: dolyame-ui-flag

    Purl: pkg:npm/dolyame-ui-flag

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.6
    MAL-2026-13155 | CVE-DB