dolyame-ui-clickable

{"modified":"2026-08-05T15:15:26Z","published":"2026-08-05T15:15:26Z","schema_version":"1.7.4","id":"MAL-2026-13145","summary":"Malicious code in dolyame-ui-clickable (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe)\nOn require() of the package, index.js unconditionally loads _init.js, which selects a platform-specific endpoint (linux_x64, linux_arm64, darwin, win32) and downloads a native binary from a rotating list of anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmod'd 0755, and spawned detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" &\"], {detached:true}) or the Windows equivalent. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to evade static matching, and the code is framed with cover-story comments as analytics/telemetry. A second, ~81 KB copy of the same fetch-and-execute pattern ships in lib/telemetry.js, using the same string-split evasion and a base64-decoded payload piped to /bin/sh with chmod 0755. The declared purpose (a UI-components package) has no need for native binary execution from anonymous infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-clickable"},"versions":["35.6.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"22f7609562e5a3991cc08aa2ad3f0aa9273991c038c644cc95eeb883d269c61a","tlsh":"90b1856a166a70184b70dbe4c6175425f55af763738082c8f79ca9881ff312482b2efc"},{"path":"lib/telemetry.js","sha256":"5e9371ecc23f9749a881111824409068ec3d2c2c716bf1824c6030b09ee9e00c","tlsh":"b6835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-clickable-35.6.2.tgz","hashes":{"sha1":"36fc11d25071a602154f1fda8ae3381ba7ef5768","sha512_sri":"sha512-ZkdFjyOSANYK/VTtv+TfnuIxOkaXzWJyRjdL62ElHuJXTfocUT6E0RKPuO1pHmWxYjPhrxLluRTMWhsbq7um0Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-clickable/v/35.6.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015627","import_time":"2026-08-05T15:20:00.787812183Z","modified_time":"2026-08-05T15:15:26Z","sha256":"f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe","source":"amazon-inspector","versions":["35.6.2"]}]}}