dolyame-ui-chart

{"modified":"2026-08-05T15:16:17Z","published":"2026-08-05T15:16:17Z","schema_version":"1.7.4","id":"MAL-2026-13142","summary":"Malicious code in dolyame-ui-chart (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9)\nOn require() of the package, index.js loads _shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The fetched bytes are written to a temp path under decoy names (e.g. dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Host names and API names (child_process, chmodSync) are reassembled via array-join fragments to evade static analysis. A secondary dropper with equivalent base64-decode + chmod 755 + spawn '/bin/sh -c <file> &' logic is bundled in lib/telemetry.js (~81KB) under an 'analytics SDK' cover story. Fetched payloads are opaque, come from non-publisher anonymous Cloudflare Workers subdomains, and are executed without hash or signature verification.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-chart"},"versions":["35.7.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"f2f475168e9355b3e22cde00106ba672e4daa181676148283d349db906edac94","tlsh":"dca1959a05aa70198bb0a7f48717441af65bf6633380c298f75ca9985f735248372efc"},{"path":"lib/telemetry.js","sha256":"e2556477ce6bb35d9247938c085879402441254c1f354709ccb2c605150e9f35","tlsh":"99835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-chart-35.7.2.tgz","hashes":{"sha1":"2a56bb6834be77beb0f6189d73b0cfda64fb44c5","sha512_sri":"sha512-o7cFk60lJxTGQw1yOygsFlooVg4q77e+vp5woo6iN53bZTdvtsQkvMDU3v6O8DJEr4dup0bNQPenerjkViDERg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-chart/v/35.7.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015632","import_time":"2026-08-05T15:20:01.020726018Z","modified_time":"2026-08-05T15:16:17Z","sha256":"d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9","source":"amazon-inspector","versions":["35.7.2"]}]}}