MAL-2026-13159

Dashboard / Malicious Package / MAL-2026-13159

MAL-2026-13159

Summary: Malicious code in dolyame-ui-icon (npm)

Details: Source: amazon-inspector (15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66) On require, index.js loads _bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (hostnames assembled at runtime via string-splitting/Array.join, e.g. ["oob-worker.cf100-416.work","ers.dev"].join("")), writes it to a temp path under a decoy name, chmods 0755 on Unix, and spawns it detached via /bin/sh -c '<path> &' (or cmd on Windows). A DNS TXT-record covert channel over *.dl.wel1.ru subdomains serves as a fallback to reassemble a base64 payload. Sensitive Node API references (require("child_"+"process"), fs["chmod"+"Sync"]) are similarly split to evade static analysis. lib/telemetry.js ships a second copy of the same dropper primitives (base64 chunk assembly, /bin/sh spawn, chmod 755) styled as a Sentry-like telemetry SDK with opt-out env-var cover comments. The delivered bytes are attacker-controlled and mutable, giving arbitrary code execution on the installer's host on module load.

References: https://www.npmjs.com/package/dolyame-ui-icon/v/35.7.5