MAL-2026-13169

Dashboard / Malicious Package / MAL-2026-13169

MAL-2026-13169

Summary: Malicious code in dolyame-ui-money (npm)

Details: Source: amazon-inspector (df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b) On require() of this package, index.js unconditionally loads _bridge.js, which downloads a platform-specific native executable from Cloudflare Workers hosts whose names are assembled at runtime via array.join("") (e.g. oob-worker.cf102-baf.workers.dev and siblings), with a DNS-TXT base64 chunked fallback resolved through *.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A /tmp state file (.analytics_state) throttles re-execution and DO_NOT_TRACK is honored to suppress the behavior in inspection environments. The package's declared purpose ("React components / UI toolkit") is unrelated to any of this. Hostname obfuscation, cover-story file names (dotnet_diag_*.exe), the DNS-TXT covert channel, and the research-evasion check together establish hostile intent; the dropped binary is opaque attacker-controlled code executed with the installer's privileges on every require().

References: https://www.npmjs.com/package/dolyame-ui-money/v/35.6.1