dolyame-ui-slider

{"modified":"2026-08-05T15:10:08Z","published":"2026-08-05T15:10:08Z","schema_version":"1.7.4","id":"MAL-2026-13184","summary":"Malicious code in dolyame-ui-slider (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba7c3d2ae4bea9c6638aa21727d88df65e96361021b4c5d458eac472191c0e86)\nOn require('dolyame-ui-slider'), index.js loads _bootstrap.js which selects a platform-specific asset path, downloads an opaque binary from one of three Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked-base64 fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under a disguised name (`.cache_<hex>` or `dotnet_diag_<hex>.exe`), chmods 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe`. Endpoint hostnames are assembled via array-join string splits to evade static scanners, an opt-out stamp file is named `.analytics_state` with a ~5.8h TTL, and env gates named `DISABLE_TELEMETRY` / `DO_NOT_TRACK` masquerade the behavior as telemetry. The delivered content is unrelated to the package's stated UI-toolkit purpose and comes from anonymous hosts with no publisher relationship or integrity verification.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-slider"},"versions":["35.3.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"f9914f817b7936812d9b20bfa2fe1d4bf65bb5637738005aedcb9f7edeea01f5","tlsh":"fbb1b79a05b770198bb09be4c62b5416f65be66336c0d2c4fb9c95885f76024c3b2efc"}],"package_integrity":[{"filename":"dolyame-ui-slider-35.3.7.tgz","hashes":{"sha1":"842824bcf36727b0453a5ac3484bfb9e685147b4","sha512_sri":"sha512-nPRBOCeKcjJNXu+8hriSWSXDgEQanknZuWPhJyCPCo/SofqPEPQV/eHb5+EJTM+QX+QxsJFbz7mY8DcP5ALQOQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-slider/v/35.3.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015593","import_time":"2026-08-05T15:19:59.535029587Z","modified_time":"2026-08-05T15:10:08Z","sha256":"ba7c3d2ae4bea9c6638aa21727d88df65e96361021b4c5d458eac472191c0e86","source":"amazon-inspector","versions":["35.3.7"]}]}}