dolyame-ui-attachfile

{"modified":"2026-08-07T12:15:14Z","published":"2026-08-07T12:15:14Z","schema_version":"1.7.4","id":"MAL-2026-13504","summary":"Malicious code in dolyame-ui-attachfile (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8)\nOn require of the package's main entry, index.js loads./lib/telemetry and./_shim. Both modules implement an import-time dropper: they select a platform-specific asset path, download opaque bytes from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, write the payload to /var/tmp or %TEMP% under a disguised name (dotnet_diag_*.exe,.cache_*), chmod 0755, and spawn it detached via /bin/sh -c or cmd /c start. Destination hostnames and DNS domains are reconstructed at runtime from split-string arrays joined together, and API names are broken up (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade static scanners. The package name impersonates a fintech (dolyame) while its shipped code is an anonymous native-binary loader with no hash or signature verification and no user consent. The Cloudflare Workers hosts and.dl.wel1.ru domains are not documented first-party endpoints for the package's stated purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-attachfile"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"93a05ae11456f71af8f9a3d8434dc58a6367c0dcd78a6e23faba761a51046e23","tlsh":"13a1965916fa70180692f5d8851f8816719ef69337c9d898fb4c66888fe712483b2dfc"},{"path":"lib/telemetry.js","sha256":"3cc48169870bb9a71b0110fe066f8e583a68a935aabd3d45bd9bc5d22d4d5c0f","tlsh":"47733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-attachfile-35.8.1.tgz","hashes":{"sha1":"daef27c6ac0ae2bedebf3a24fc9190e72a43725f","sha512_sri":"sha512-wdDJuiPe4QeNSKjyCqdpLeX/4m5jy3IXPefi6Q0sLEumTtC/xy4GCc0fAwX7LmFmkVxjgr2ebLg5Q2kkHPKcdA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-attachfile/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016902","import_time":"2026-08-07T12:23:26.470744541Z","modified_time":"2026-08-07T12:15:14Z","sha256":"94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8","source":"amazon-inspector","versions":["35.8.1"]}]}}