MAL-2026-13587
Dashboard / Malicious Package / MAL-2026-13587
MAL-2026-13587
Summary: Malicious code in dolyame-ui-inputtools (npm)
Details: Source: amazon-inspector (b19507e10e8c209d60c32cbff9d46f8cc96774c67892192be7550d75064cfb63) On require(), index.js loads _bridge.js which assembles per-platform executable URLs from string-split fragments resolving to rotating Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf102-baf, cf99-9b3, cf101-adf) and *.dl.wel1.ru (sdk/ext/pkg/net subdomains), with a DNS TXT covert-channel fallback that reassembles base64 chunks from numbered subdomain TXT records. Downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). No hash or signature verification is performed and the destinations are not publisher infrastructure. The same fetch->write->chmod+x->detached-spawn chain is duplicated in lib/telemetry.js (the package's main export), which frames itself as an 'Analytics SDK / observability' module and obfuscates the child_process require via string concatenation (require("child_"+"process")) and the fs.chmodSync call via fs["chmod"+"Sync"]. The 'ui-inputtools' package name and the telemetry cover story do not match the shipped behavior.
Affected packages
Package
Name: dolyame-ui-inputtools
Purl: pkg:npm/dolyame-ui-inputtools
Affected ranges
Type: N/A
Events:
