MAL-2026-13509
Dashboard / Malicious Package / MAL-2026-13509
MAL-2026-13509
Summary: Malicious code in dolyame-ui-lazyrender (npm)
Details: Source: amazon-inspector (7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419) On require of dolyame-ui-lazyrender, `_helpers.js` selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf101-adf.workers.dev`, and `oob-worker.cf100-416.workers.dev` hosts (with DNS-based fallback to `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`), writes the payload to a hidden temp file, applies chmod 0755, and detach-spawns it via `/bin/sh -c "<path> &"` or `cmd.exe /c start /b`. No hash or signature verification is performed and the destination hosts are unrelated to the package's declared purpose. A second, redundant dropper implementation in `lib/telemetry.js` (reached via the package's main entry point) reconstructs `require("child_process")` and `fs["chmodSync"]` from concatenated fragments, base64-decodes chunked transport data, chmods the extension file to 0755, and spawns it via `/bin/sh -c`. Hostnames and dangerous API names are assembled at runtime from split arrays (e.g. `["oob-worker.cf99-9b3.w","ork","ers.d","ev"].join("")`, `require("child_" + "process")`) to evade static inspection.
Affected packages
Package
Name: dolyame-ui-lazyrender
Purl: pkg:npm/dolyame-ui-lazyrender
Affected ranges
Type: N/A
Events:
