MAL-2026-13590
Dashboard / Malicious Package / MAL-2026-13590
MAL-2026-13590
Summary: Malicious code in dolyame-ui-noindex (npm)
Details: Source: amazon-inspector (dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e) On require(), index.js loads./_ext which selects a platform-specific payload (linux_x64/arm64, darwin, win32), downloads an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru hosts whose names are reconstructed from split string arrays, writes it to /tmp or the Windows temp directory under a disguised name (a hidden.cache_<hex> file or a dotnet_diag_<hex>.exe lookalike), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-based fallback channel reassembles base64 payload chunks from numbered subdomains of ext.dl.wel1.ru / sdk.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru when HTTPS is blocked. The same drop-and-exec routine is duplicated in lib/telemetry.js, where the child_process require is also split-string obfuscated. The package name resembles a legitimate UI library but the shipped code contains no such library — its only import-time effect is to fetch and execute an opaque remote binary.
Affected packages
Package
Name: dolyame-ui-noindex
Purl: pkg:npm/dolyame-ui-noindex
Affected ranges
Type: N/A
Events:
