MAL-2026-13158

Dashboard / Malicious Package / MAL-2026-13158

MAL-2026-13158

Summary: Malicious code in dolyame-ui-group (npm)

Details: Source: amazon-inspector (714598919807b4143a734772e690ff94aa986fb6cf61bd99026e7f7bc93f4cf2) On require() of the package's main entry, _loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames reconstructed at runtime via array-join splits (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The downloaded bytes are written to a temp path with cover-story names (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on POSIX), chmod 0755, and spawned detached via /bin/sh -c or cmd. A second co-shipped dropper module lib/telemetry.js, styled as an analytics SDK, contains the same base64-decode -> write -> chmod 755 -> spawn("/bin/sh", ["-c", filePath+" &"]) chain. Sensitive API names are hidden via string concatenation (require("child_"+"process"), fs["chmod"+"Sync"], os["host"+"name"]()) to defeat static grep. Fetch-and-execute of an opaque, unversioned, non-publisher binary from anonymous workers.dev infrastructure at library-load time is arbitrary code execution on the installer's host.

References: https://www.npmjs.com/package/dolyame-ui-group/v/35.9.7