MAL-2026-13558
Dashboard / Malicious Package / MAL-2026-13558
MAL-2026-13558
Summary: Malicious code in dolyame-ui-clickoutsidehoc (npm)
Details: Source: amazon-inspector (f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57) On require() of this package, index.js loads _shim.js which assembles hostnames from split string fragments to hide them (e.g. ["oob-work","er.cf100-416.workers",".dev"].join("") and ['sd','k.dl.wel1.r','u'].join("")), fetches a platform-specific executable from Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes the binary to /tmp or %TEMP% under a disguised name (dotnet_diag_<rnd>.exe or.cache_<rnd>), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. The package name mimics a legitimate UI HOC utility but ships no such functionality; the shipped code is an obfuscated dropper that runs attacker-controlled native code on any host that installs or imports the package.
Affected packages
Package
Name: dolyame-ui-clickoutsidehoc
Purl: pkg:npm/dolyame-ui-clickoutsidehoc
Affected ranges
Type: N/A
Events:
