dolyame-ui-calendar

{"modified":"2026-08-05T15:15:35Z","published":"2026-08-05T15:15:35Z","schema_version":"1.7.4","id":"MAL-2026-13140","summary":"Malicious code in dolyame-ui-calendar (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1110e4e32da50573666c0e5f281db639994fad22ed178e2039b9689cc350c284)\nThe package advertises itself as a zero-dependency React calendar component library, but on require() of index.js it loads _shim.js, which selects a platform-specific path, fetches an opaque binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev — hostnames assembled via array-join to evade string scanners), writes it to a hidden temp file, chmods 0755, and spawns it detached via /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. A fallback path resolves DNS TXT records at c.<domain> and 0..N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, concatenates the responses, base64-decodes them into an executable, and feeds the result into the same write/chmod/spawn sink — a covert channel that bypasses network egress controls blocking unknown HTTP hosts. Additional evasion appears in lib/telemetry.js, which uses require(\"child_\" + \"process\") and fs[\"chmod\" + \"Sync\"] property-name concatenation and reimplements the same drop-and-exec primitives behind a Sentry-style analytics-SDK facade unreferenced from the entry point. Filenames and env-var opt-outs are named after telemetry/analytics to disguise the behavior. The fetched bytes are unpinned, unverified, and delivered from infrastructure unrelated to the advertised calendar-UI purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-calendar"},"versions":["35.1.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"c7236e3b1a45fb2668e4e3ae20a79d319a16b178b828e5a0729772e29e8fa7b6","tlsh":"aba1865a16a630188bb0d7e4c71b5416f65bf66333808684fb9c69981fb316483b3efc"},{"path":"lib/telemetry.js","sha256":"f2084dcb429c5dacbb79ff3cfe352339a9b44e6cb7e8b57391ccae9a27db982f","tlsh":"8c835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-calendar-35.1.8.tgz","hashes":{"sha1":"e726b5b53b1f2c4728b118bf017b392aed3c459f","sha512_sri":"sha512-ycvButUfHzvSpqIELgw8FA5zH8NI1puRukExe64Do1x7+uNpTvDBZjnWQRjnRFWVXyvaY5JwnQiSMMnsfGfXQg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-calendar/v/35.1.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015628","import_time":"2026-08-05T15:20:00.893345569Z","modified_time":"2026-08-05T15:15:35Z","sha256":"1110e4e32da50573666c0e5f281db639994fad22ed178e2039b9689cc350c284","source":"amazon-inspector","versions":["35.1.8"]}]}}