dolyame-ui-lazyrender

{"modified":"2026-08-07T12:12:32Z","published":"2026-08-07T12:12:32Z","schema_version":"1.7.4","id":"MAL-2026-13509","summary":"Malicious code in dolyame-ui-lazyrender (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419)\nOn require of dolyame-ui-lazyrender, `_helpers.js` selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf101-adf.workers.dev`, and `oob-worker.cf100-416.workers.dev` hosts (with DNS-based fallback to `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`), writes the payload to a hidden temp file, applies chmod 0755, and detach-spawns it via `/bin/sh -c \"<path> &\"` or `cmd.exe /c start /b`. No hash or signature verification is performed and the destination hosts are unrelated to the package's declared purpose. A second, redundant dropper implementation in `lib/telemetry.js` (reached via the package's main entry point) reconstructs `require(\"child_process\")` and `fs[\"chmodSync\"]` from concatenated fragments, base64-decodes chunked transport data, chmods the extension file to 0755, and spawns it via `/bin/sh -c`. Hostnames and dangerous API names are assembled at runtime from split arrays (e.g. `[\"oob-worker.cf99-9b3.w\",\"ork\",\"ers.d\",\"ev\"].join(\"\")`, `require(\"child_\" + \"process\")`) to evade static inspection.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-lazyrender"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"4d0fcdc130009f33beda01b61530b5f4ba9a5057680cbb0f7375335aac2d3c1b","tlsh":"e4a1b65516fa300806a3e5d4861f9826719ee6633394d8d8ff4c66844fea178c3f25fc"},{"path":"lib/telemetry.js","sha256":"a6cc9860007a63719cbf4d473500e36428209c360107d0450ebe270be0e7aac5","tlsh":"3473304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-lazyrender-35.8.1.tgz","hashes":{"sha1":"09582799eb12feeb4f9628bb184a7e47647d12b2","sha512_sri":"sha512-PWmv2lkFnx4axFDtFKowRgCFSDzMKpzrR4tvovJ8CXebU216AhU3sm4k41qCpjcK1zhtKBfFFhn9uSnFWyv83Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-lazyrender/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016883","import_time":"2026-08-07T12:23:25.661111444Z","modified_time":"2026-08-07T12:12:32Z","sha256":"7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419","source":"amazon-inspector","versions":["35.8.1"]}]}}