MAL-2026-13507
Dashboard / Malicious Package / MAL-2026-13507
MAL-2026-13507
Summary: Malicious code in dolyame-ui-inputcolor (npm)
Details: Source: amazon-inspector (abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238) index.js unconditionally requires./_loader on load. _loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners (e.g., ["oob-w","orker",".cf","101-adf.workers.","de","v"].join("")), selects an OS-specific endpoint, and fetches a binary payload over HTTPS from one of four oob-worker.cf10[0-3]-*.workers.dev hosts. On HTTPS failure, it falls back to a DNS-TXT covert channel: it queries chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-concatenates the chunks, and reconstitutes the payload buffer. The bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. Module names, API names, and hostnames are reconstructed via string concatenation and dynamic property access (require("child_" + "process"), fs["chmod" + "Sync"], os["host" + "name"]) to defeat plain-text matching. The dropper fires on every require() of this package, granting the operator of those hosts arbitrary code execution on any machine that installs or imports it.
Affected packages
Package
Name: dolyame-ui-inputcolor
Purl: pkg:npm/dolyame-ui-inputcolor
Affected ranges
Type: N/A
Events:
