MAL-2026-13178

    Dashboard / Malicious Package / MAL-2026-13178

    MAL-2026-13178

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-react-dom-wrapper (npm)

    Details: Source: amazon-inspector (3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b) On require of the package's main entry, _helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlled Cloudflare Worker subdomains (oob-worker.cf99-9b3.workers.dev, cf103-070/cf100-416/cf102-baf.workers.dev) with a DNS-based fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under disguised names ('.cache_<rnd>', 'dotnet_diag_<rnd>.exe'), chmods 0755 on Unix, and detached-spawns the file via '/bin/sh -c <path> &' or 'cmd /c start'. C2 hostnames and sensitive API names (child_process, chmodSync) are assembled at runtime from split-string arrays joined with '' to defeat static analysis. A second copy of the same fetch → base64 → chmod 0755 → detached-spawn chain, with identical string-concatenation obfuscation of 'child_process', is bundled in lib/telemetry.js as a parallel dropper. Any installer that requires this package executes attacker-controlled binaries with the user's privileges.

    References: https://www.npmjs.com/package/dolyame-ui-react-dom-wrapper/v/35.8.9

    Affected packages

    Package

    Name: dolyame-ui-react-dom-wrapper

    Purl: pkg:npm/dolyame-ui-react-dom-wrapper

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.9