MAL-2026-13181

Dashboard / Malicious Package / MAL-2026-13181

MAL-2026-13181

Summary: Malicious code in dolyame-ui-scroll (npm)

Details: Source: amazon-inspector (a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247) On require() of the package main, _init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of author-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). Destination hostnames are reconstructed at runtime via array-join string splitting to defeat static inspection. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 755'd on POSIX, and executed detached via spawn('/bin/sh','-c',...) or spawn('cmd', ['/c','start',...]). If HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel against *.dl.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reassembles a base64-chunked payload from TXT records, and executes the reconstructed binary. No signature or hash verification is performed, and the fetch-and-execute behavior is unrelated to the package's stated UI-components purpose.

References: https://www.npmjs.com/package/dolyame-ui-scroll/v/35.4.3