dolyame-ui-types

{"modified":"2026-08-05T15:08:33Z","published":"2026-08-05T15:08:33Z","schema_version":"1.7.4","id":"MAL-2026-13198","summary":"Malicious code in dolyame-ui-types (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38)\nOn require() of the package, _helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS-TXT fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to a disguised path (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at load time from split-string arrays joined with.join(\"\") to evade static string matching. The package name suggests a type-definitions library, which has no need for outbound network I/O, binary retrieval, or child process execution.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-types"},"versions":["35.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"b5ecccf2d3cd7818feeae66fe7ebde8a9f1d7a0ae8cd65e1ca6ae026f401408b","tlsh":"9fa1a66a166a701847b0d7e4c7176816f65af6637380c2d8f79c69981fb212482b3efc"}],"package_integrity":[{"filename":"dolyame-ui-types-35.8.2.tgz","hashes":{"sha1":"8e18f0334d9356d05e6ade1c2614049777df06a7","sha512_sri":"sha512-RVqh7CoA+j0PSVKP7ucmhcO5UB0vghODsI17vHGaqxVxHX9qsD+KJHoe86fL3/OtewpBk1mAILDdlDuRJ4jrzg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-types/v/35.8.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015582","import_time":"2026-08-05T15:19:59.080220487Z","modified_time":"2026-08-05T15:08:33Z","sha256":"237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38","source":"amazon-inspector","versions":["35.8.2"]}]}}