MAL-2026-13198

    Dashboard / Malicious Package / MAL-2026-13198

    MAL-2026-13198

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-types (npm)

    Details: Source: amazon-inspector (237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38) On require() of the package, _helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS-TXT fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to a disguised path (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at load time from split-string arrays joined with.join("") to evade static string matching. The package name suggests a type-definitions library, which has no need for outbound network I/O, binary retrieval, or child process execution.

    References: https://www.npmjs.com/package/dolyame-ui-types/v/35.8.2

    Affected packages

    Package

    Name: dolyame-ui-types

    Purl: pkg:npm/dolyame-ui-types

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.2
    MAL-2026-13198 | CVE-DB