dolyame-ui-badge

{"modified":"2026-08-05T15:18:56Z","published":"2026-08-05T15:18:56Z","schema_version":"1.7.4","id":"MAL-2026-13136","summary":"Malicious code in dolyame-ui-badge (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (11c1280f596630bc692c2587a15a33bd01b2b745875cfe8a590e6787757867dd)\nOn require() of dolyame-ui-badge, the package loads _bootstrap.js which downloads a native binary from runtime-assembled Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS TXT-record fallback channel over *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe and.cache_*, chmods it to 0o755, and spawns it detached via /bin/sh -c or cmd.exe /c start. Destination hostnames are obfuscated by splitting them across array elements and reconstructing at runtime via.join(\"\"). Cover-story comments referencing SHA-256 verification, opt-out flags, and rate-limiting do not correspond to matching code. The package advertises itself as a UI badge component and has no build-time or functional need for a native binary. No signature or hash verification is performed on the downloaded payload.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-badge"},"versions":["35.4.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"ea80d2604e12788de6244c8c3ea84ffd1a17f2ffc5a6f86188ce3c866f9b4e19","tlsh":"36a1879a167670184bb0d7f4871b5815f65bf66333c08198fb9c69881fb212483b2efc"}],"package_integrity":[{"filename":"dolyame-ui-badge-35.4.4.tgz","hashes":{"sha1":"c599a2b66f95f1c56c2be6524b7d911f40a6fb46","sha512_sri":"sha512-y7aq+Q+OFlc5DllG8ucvLSqBa+7hhJz/W6KO3YDd5ChdkiDBWI3rpNaTp1YVeVKbu4Gcv+KIwUYx3q4wczndfA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-badge/v/35.4.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015650","import_time":"2026-08-05T15:20:01.669035619Z","modified_time":"2026-08-05T15:18:56Z","sha256":"11c1280f596630bc692c2587a15a33bd01b2b745875cfe8a590e6787757867dd","source":"amazon-inspector","versions":["35.4.4"]}]}}