dolyame-ui-contenteditable

{"modified":"2026-08-07T12:24:58Z","published":"2026-08-07T12:24:58Z","schema_version":"1.7.4","id":"MAL-2026-13560","summary":"Malicious code in dolyame-ui-contenteditable (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0)\nOn require() of the package, index.js unconditionally loads./_compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames (oob-worker.cf101-adf.workers.dev family) from split string literals, selects an OS/arch-specific remote path, downloads a binary, writes it to /tmp or %TEMP% under disguised names (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-record chunked-base64 fallback channel under c.<domain> and numeric subdomains of *.dl.wel1.ru (sdk.dl.wel1.ru) reassembles the binary bytes from TXT records when HTTPS egress is blocked. A second parallel dropper in lib/telemetry.js (reached via index.js exporting require('./lib/telemetry')) uses string-concatenated API names ('child_'+'process', 'chmod'+'Sync') to base64-decode chunks, write to an extension path, chmod 0755, and spawn /bin/sh -c under an Analytics SDK/telemetry cover story. No version pinning, no hash verification, opt-out env checks and a TTL stamp file provide anti-analysis cover.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-contenteditable"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"3ac153cc8a125f479636ed10c216d363ffab53bff1c0eca20e6881784b40c462","tlsh":"d9a1a55a16fa70180393e4c5851ba812719ef65333c4d984fb8c6a989fd622583f3afc"},{"path":"lib/telemetry.js","sha256":"cb129658ba8be6ed3f1ff04175e986570c1b6761ee016ee3c307a959ca4a669b","tlsh":"5b73304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-contenteditable-35.8.1.tgz","hashes":{"sha1":"8b1be0eb81b37463d746fd650ada9f6d1e5ad4e4","sha512_sri":"sha512-PvP3Kf3vGzuxbCOvEAptLqnR4gpK/vd0B8lEzy3meM05hWcltD6l8ypnHCJ6pJoDZoitFei/6156DnefyqqaKg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-contenteditable/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016971","import_time":"2026-08-07T12:51:20.350806174Z","modified_time":"2026-08-07T12:24:58Z","sha256":"9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0","source":"amazon-inspector","versions":["35.8.1"]}]}}