dolyame-ui-colors

{"modified":"2026-08-05T15:16:34Z","published":"2026-08-05T15:16:34Z","schema_version":"1.7.4","id":"MAL-2026-13147","summary":"Malicious code in dolyame-ui-colors (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310)\ndolyame-ui-colors@35.8.9 is advertised as a React UI color library but its main entry requires./_shim.js on load, which acts as a platform-aware binary dropper. _shim.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four Cloudflare Workers hosts whose names are assembled at runtime by splitting and rejoining string fragments (e.g. \"oob-worker.cf103-070.wo\"+\"rk\"+\"ers.\"+\"dev\"): oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev. A DNS-TXT covert-channel fallback reassembles a base64 payload from numbered TXT records under c.<domain> for the hosts sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 755'd, and spawned detached via spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}).unref() (or a cmd equivalent on Windows). A ~6.5-hour lock file throttles re-runs to reduce visibility. The stated React-component purpose is a cover story; the destinations, drop paths, and execution shape indicate deliberate supply-chain attack code.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-colors"},"versions":["35.8.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"4005ab59880b47249cd112a70bd15cc2f393f213f101f5940ce05254df43cb43","tlsh":"5cb184aa127670184bb0dbe5c7175415f55af2a37680c294f79c99981fb312483f2efc"}],"package_integrity":[{"filename":"dolyame-ui-colors-35.8.9.tgz","hashes":{"sha1":"e5362a689ef6e2fc31eeecb4c7440ae2853baf2c","sha512_sri":"sha512-AKOtAKrABZ/4pqr+Fvs7Dc2xIylqelxEhRp0BE8m5vPLcti8M98wz46mEF7Tog038AR5l0o8yVVDWpG9I0IFmg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-colors/v/35.8.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015634","import_time":"2026-08-05T15:20:01.078270151Z","modified_time":"2026-08-05T15:16:34Z","sha256":"d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310","source":"amazon-inspector","versions":["35.8.9"]}]}}