MAL-2026-13156

    Dashboard / Malicious Package / MAL-2026-13156

    MAL-2026-13156

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-footer (npm)

    Details: Source: amazon-inspector (3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca) On require() of dolyame-ui-footer, index.js loads./_runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked fallback channel that reconstructs a base64 payload from TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are assembled at runtime via array-join to hide them from static analysis. On POSIX the fetched binary is written to /var/tmp with a disguised name (.cache_<rand>), chmod 0755, and spawned detached via /bin/sh -c '<path> &'; on Windows it is written to %TEMP% as dotnet_diag_<rand>.exe and spawned. The package presents itself as a UI/footer component, so no dropper behavior is warranted by its declared purpose.

    References: https://www.npmjs.com/package/dolyame-ui-footer/v/35.5.8

    Affected packages

    Package

    Name: dolyame-ui-footer

    Purl: pkg:npm/dolyame-ui-footer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.8
    MAL-2026-13156 | CVE-DB