MAL-2026-13602

    Dashboard / Malicious Package / MAL-2026-13602

    MAL-2026-13602

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in dolyame-ui-tabslayout (npm)

    Details: Source: amazon-inspector (eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd) On require of the package, index.js loads lib/telemetry.js and _polyfill.js, both of which contain dropper logic that selects an OS-specific path, fetches a binary from one of three obfuscated Cloudflare Workers URLs (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-over-DNS-TXT fallback from *.dl.wel1.ru, writes the payload to a temp path under cover names such as dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames and dangerous API references are assembled at runtime by string-splitting concatenation (e.g. ['oob-worker.cf102-baf','.worke','rs.dev'].join(''), require('child_' + 'process'), fs['chmod'+'Sync']) to evade static scanners. The package presents itself as build/deployment tooling and wraps the dropper inside a fake Sentry-style analytics SDK.

    References: https://www.npmjs.com/package/dolyame-ui-tabslayout/v/35.8.1

    Affected packages

    Package

    Name: dolyame-ui-tabslayout

    Purl: pkg:npm/dolyame-ui-tabslayout

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.1
    MAL-2026-13602 | CVE-DB