MAL-2026-13508
Dashboard / Malicious Package / MAL-2026-13508
MAL-2026-13508
Summary: Malicious code in dolyame-ui-inputpassword (npm)
Details: Source: amazon-inspector (fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674) On require of the package, index.js loads lib/telemetry.js which, together with _bootstrap.js, fetches a platform-specific binary from a rotating list of anonymous Cloudflare Workers hosts (oob-worker.cf1{00,01,02,03}-*.workers.dev) with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru (chunk count from c.<domain>, base64 chunks from indexed TXT records reassembled via Buffer.from(..., 'base64')). The fetched bytes are written to a disguised temp path (.cache_<hex>/dotnet_diag_<hex>.exe), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Destination hostnames and module names are assembled from split string fragments (e.g. 'oob-worker.cf103-070.wo'+'rkers.d'+'ev', require('child_'+'process'), fs['chmod'+'Sync']) to evade static string search. The package presents itself as a UI input-password wrapper; the dropper behavior is unrelated to that stated purpose and is duplicated across _bootstrap.js and lib/telemetry.js so it fires whether the package is loaded via the main entry or the bootstrap side-effect.
Affected packages
Package
Name: dolyame-ui-inputpassword
Purl: pkg:npm/dolyame-ui-inputpassword
Affected ranges
Type: N/A
Events:
