MAL-2026-13188

    Dashboard / Malicious Package / MAL-2026-13188

    MAL-2026-13188

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-swiper (npm)

    Details: Source: amazon-inspector (5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a) On require() of the package's main entry, _bridge.js unconditionally runs an init() routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, writes it under /tmp or %TEMP% with a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Destination hostnames and the child_process identifier are assembled at runtime by joining string fragments to evade static inspection. The package is advertised as a UI component library; the fetched binary has no relationship to that stated purpose, is hosted on anonymous edge-worker infrastructure, is unpinned and unverified, and is executed with the privileges of the installing process. Requiring or installing the package results in arbitrary remote code execution on the installer's host.

    References: https://www.npmjs.com/package/dolyame-ui-swiper/v/35.7.7

    Affected packages

    Package

    Name: dolyame-ui-swiper

    Purl: pkg:npm/dolyame-ui-swiper

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.7