dolyame-ui-checkablegroup

{"modified":"2026-08-07T12:36:06Z","published":"2026-08-07T12:36:06Z","schema_version":"1.7.4","id":"MAL-2026-13557","summary":"Malicious code in dolyame-ui-checkablegroup (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97)\nThe package presents itself as a UI checkable-group helper but on require executes a dropper. `_helpers.js` and the main-exported `lib/telemetry.js` assemble destination hostnames at runtime from split-string arrays (e.g. `[\"oob-worker.cf1\",\"00-416.work\",\"er\",\"s.dev\"].join(\"\")` yielding `oob-worker.cf100-416.workers.dev`, plus `cf101-adf` and `cf103-070` siblings), select a platform-specific endpoint, download an opaque binary via `https.get`, write it to `/tmp` or `%TEMP%` under a spoofed name mimicking a Microsoft diagnostic tool (`dotnet_diag_<hex>.exe`, `.cache_<hex>`), `chmodSync` 0755, and spawn it detached via `cp.spawn(\"/bin/sh\",[\"-c\", filePath+\" &\"], {detached:true})` on Unix or `cmd.exe /c start /b` on Windows. A covert DNS-TXT fallback channel under `*.dl.wel1.ru` reassembles a base64 payload from numbered subdomains (`c.<domain>` for count, `<i>.<domain>` for chunks). No hash or signature verification is performed. The dropper is duplicated across `_helpers.js` and the main-exported `lib/telemetry.js`, ensuring execution on any `require` of the package. Hostname obfuscation via split-string concatenation, spoofed on-disk names, detached execution, and the DNS-TXT covert channel are consistent with purpose-built malware distributed as a UI-helper lure.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-checkablegroup"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"d051af3a58cb08db09b2e4a0a4f9530a205200a592e973be01cb523031d3d6d9","tlsh":"44a1735916fa70180792e0d8852fa416719ef59372c4d8d4fb8c6a984fe7228c3b39fc"},{"path":"lib/telemetry.js","sha256":"730f8b1bcba564ecdedd133600e3e0cb509cd9bb30ed582fb002e9dd634996bf","tlsh":"8e73304966fb10214263b0685ebb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-checkablegroup-35.8.1.tgz","hashes":{"sha1":"385c475a176cba1f2697aebe9a1794f48b4fc114","sha512_sri":"sha512-sO+XVDKhmxaRwD0dEjsN9zRcjAOFUSqPnqZILmemiIvyFzDqJDKFQ+Iv7gNl7686l4RhUqV81kL86eASdBNFQg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-checkablegroup/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017046","import_time":"2026-08-07T12:51:23.739124106Z","modified_time":"2026-08-07T12:36:06Z","sha256":"ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97","source":"amazon-inspector","versions":["35.8.1"]}]}}