dolyame-ui-cardlogo

{"modified":"2026-08-07T12:31:07Z","published":"2026-08-07T12:31:07Z","schema_version":"1.7.4","id":"MAL-2026-13555","summary":"Malicious code in dolyame-ui-cardlogo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d)\nOn load, index.js require()s _polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via string-array concatenation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback resolving to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched binary is written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are assembled from split string arrays, temp filenames imitate legitimate diagnostic tooling, and helper functions carry 'telemetry'/'analytics' cover-story naming with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks — none of this behavior relates to the package's stated UI purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-cardlogo"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"5930298da2d67019bed91100f7f0fbd1e5e38394416340280d4095c137b7aedf","tlsh":"cda1e71915fb701803a2e5d4851f6416329bf6533284e9c8ff4c66849fab17883f38ec"}],"package_integrity":[{"filename":"dolyame-ui-cardlogo-35.8.1.tgz","hashes":{"sha1":"ff06f942a0e8eb0634fd5e0360144ce7b0b458e0","sha512_sri":"sha512-8CN+svnkGcNHS8dgsq/EsYo0um6P4dJ9miIooAvZfzaz2Z1CPt1FbuNDMNmm7mDqvrdxYmGO2x0dafEes0XhvQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-cardlogo/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017013","import_time":"2026-08-07T12:51:22.166892778Z","modified_time":"2026-08-07T12:31:07Z","sha256":"e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d","source":"amazon-inspector","versions":["35.8.1"]}]}}