MAL-2026-13199

    Dashboard / Malicious Package / MAL-2026-13199

    MAL-2026-13199

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-ui-utils (npm)

    Details: Source: amazon-inspector (899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199) On require of the package, _polyfill.js selects a platform-keyed URL, fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a base64-chunked DNS-TXT fallback channel over *.dl.wel1.ru, writes it to /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. No hash or signature verification is performed and destinations are unrelated to the package publisher. lib/telemetry.js ships a parallel dropper implementation with additional evasion (split require("child_"+"process"), dynamic fs["chmod"+"Sync"]) as staged secondary payload. An analytics_state marker file and DISABLE_TELEMETRY env var provide cover framing.

    References: https://www.npmjs.com/package/dolyame-ui-utils/v/35.6.7

    Affected packages

    Package

    Name: dolyame-ui-utils

    Purl: pkg:npm/dolyame-ui-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.7
    MAL-2026-13199 | CVE-DB