dolyame-ui-progresscircle

{"modified":"2026-08-07T12:14:33Z","published":"2026-08-07T12:14:33Z","schema_version":"1.7.4","id":"MAL-2026-13510","summary":"Malicious code in dolyame-ui-progresscircle (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d)\nThe package's main entry unconditionally loads _ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback resolving to *.dl.wel1.ru, writes it to /tmp or %TEMP% under decoy names such as.cache_<uid> or dotnet_diag_<uid>.exe, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. Host names and sensitive API references (child_process, os.hostname, fs.chmodSync) are reassembled from split string arrays to evade static matching. lib/telemetry.js contains a redundant loader that base64-decodes embedded chunks, writes them to disk, chmods 0755, and detached-spawns the resulting binary. The package presents itself as a UI progress-circle / monitoring SDK but ships no functionality matching that description.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-progresscircle"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"23b4a130d3c23e27589b95e8f476eb93753e95ba9fc537b19df724cd038d6d48","tlsh":"baa1945a17fa70180692e1d8452f5816b19ee69333c8d9d4ff4ca6944fea12483b39fc"},{"path":"lib/telemetry.js","sha256":"45460e3714e288d63e0a303d08e02d6999693daed154b2beb697d0bb47710858","tlsh":"f9733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-progresscircle-35.8.1.tgz","hashes":{"sha1":"7c76262f1a899bea1f9c28088669e131d490549c","sha512_sri":"sha512-T53DL04jMq3rmcxS4upmbnueVwwXHBe0Az9lj6Idg+yS5JUncsoo00vB2ks2A4szyjxrwMF874K8O7fxi2WDqQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-progresscircle/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016897","import_time":"2026-08-07T12:23:26.243708642Z","modified_time":"2026-08-07T12:14:33Z","sha256":"248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d","source":"amazon-inspector","versions":["35.8.1"]}]}}