dolyame-ui-inputcolor

{"modified":"2026-08-07T12:14:49Z","published":"2026-08-07T12:14:49Z","schema_version":"1.7.4","id":"MAL-2026-13507","summary":"Malicious code in dolyame-ui-inputcolor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238)\nindex.js unconditionally requires./_loader on load. _loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners (e.g., [\"oob-w\",\"orker\",\".cf\",\"101-adf.workers.\",\"de\",\"v\"].join(\"\")), selects an OS-specific endpoint, and fetches a binary payload over HTTPS from one of four oob-worker.cf10[0-3]-*.workers.dev hosts. On HTTPS failure, it falls back to a DNS-TXT covert channel: it queries chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-concatenates the chunks, and reconstitutes the payload buffer. The bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. Module names, API names, and hostnames are reconstructed via string concatenation and dynamic property access (require(\"child_\" + \"process\"), fs[\"chmod\" + \"Sync\"], os[\"host\" + \"name\"]) to defeat plain-text matching. The dropper fires on every require() of this package, granting the operator of those hosts arbitrary code execution on any machine that installs or imports it.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inputcolor"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"d501c2c8b36f18b89460df9732aa93dc34533cf0f96e48e3b05637867c3ca38b","tlsh":"8da1a5551afa70180692e2d4c81f8826b19ef5533784e5d4fb4c6a988fd752883b29ec"}],"package_integrity":[{"filename":"dolyame-ui-inputcolor-35.8.1.tgz","hashes":{"sha1":"0888bfeb35292574a2712b7233226c92f188d70c","sha512_sri":"sha512-/kCr4UTB1nTjhZp0/SMnJgsAOMEWm9KSUy5qwLJUM9B4AySBnIFjqzY9QsFTFs6321NfdnXuyUU1k1OL+3zhZA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputcolor/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016899","import_time":"2026-08-07T12:23:26.34241259Z","modified_time":"2026-08-07T12:14:49Z","sha256":"abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238","source":"amazon-inspector","versions":["35.8.1"]}]}}