MAL-2026-13593

    Dashboard / Malicious Package / MAL-2026-13593

    MAL-2026-13593

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in dolyame-ui-popupcarousel (npm)

    Details: Source: amazon-inspector (2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6) On require of the package, _support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback via *.dl.wel1.ru, write the payload to /tmp or %TEMP% under decoy filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. Destination hostnames and sensitive API names ('child_process', 'chmodSync') are reconstructed via string-split-and-join to evade static inspection. The main entry unconditionally require()s _support.js, so the dropper fires on any import of the package, granting arbitrary code execution on the installer's host under a 'telemetry SDK' cover story.

    References: https://www.npmjs.com/package/dolyame-ui-popupcarousel/v/35.8.1

    Affected packages

    Package

    Name: dolyame-ui-popupcarousel

    Purl: pkg:npm/dolyame-ui-popupcarousel

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.1
    MAL-2026-13593 | CVE-DB