MAL-2026-13510
Dashboard / Malicious Package / MAL-2026-13510
MAL-2026-13510
Summary: Malicious code in dolyame-ui-progresscircle (npm)
Details: Source: amazon-inspector (248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d) The package's main entry unconditionally loads _ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback resolving to *.dl.wel1.ru, writes it to /tmp or %TEMP% under decoy names such as.cache_<uid> or dotnet_diag_<uid>.exe, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. Host names and sensitive API references (child_process, os.hostname, fs.chmodSync) are reassembled from split string arrays to evade static matching. lib/telemetry.js contains a redundant loader that base64-decodes embedded chunks, writes them to disk, chmods 0755, and detached-spawns the resulting binary. The package presents itself as a UI progress-circle / monitoring SDK but ships no functionality matching that description.
Affected packages
Package
Name: dolyame-ui-progresscircle
Purl: pkg:npm/dolyame-ui-progresscircle
Affected ranges
Type: N/A
Events:
