MAL-2026-13581
Dashboard / Malicious Package / MAL-2026-13581
MAL-2026-13581
Summary: Malicious code in dolyame-ui-inputrange (npm)
Details: Source: amazon-inspector (aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f) On require of dolyame-ui-inputrange, _init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins (e.g. ["oob-worke","r.cf101-adf.workers.de","v"].join("")) plus a DNS-TXT fallback under *.dl.wel1.ru, downloads a platform-specific binary, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), sets mode 0755 via bracket-property assembly (fs["chmod"+"Sync"]), and spawns it detached via cp.spawn("/bin/sh", ["-c", filePath+" &"], {detached:true}).unref(). No native source is shipped in the tarball and the fetched bytes are opaque. lib/telemetry.js, re-exported by the package's main entry, duplicates the same dropper primitives (base64-decoded chunks written to disk, chmod 755, /bin/sh -c spawn) behind an "Analytics SDK" cover story, ensuring execution persists even if _init.js is stripped. Runtime string reassembly of module names (require("child_"+"process")) and destination hosts, plus opt-out env-var gates (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a TTL cache file, are used to evade static analysis and hide repeat executions.
Affected packages
Package
Name: dolyame-ui-inputrange
Purl: pkg:npm/dolyame-ui-inputrange
Affected ranges
Type: N/A
Events:
