dolyame-ui-datatable

{"modified":"2026-08-07T12:34:27Z","published":"2026-08-07T12:34:27Z","schema_version":"1.7.4","id":"MAL-2026-13565","summary":"Malicious code in dolyame-ui-datatable (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33)\nThe package's main entry requires _platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru, writes it to /tmp or Windows TEMP with an innocuous name (dot-prefixed cache file or dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at runtime from split-string arrays joined with.join(''), and require('child_process') is likewise assembled as require('child_' + 'process') to evade static matching. A second equivalent dropper path exists in lib/telemetry.js (also reachable via package main), providing redundant execution of arbitrary fetched bytes. The package is named 'dolyame-ui-datatable' with description 'Shared configuration and helpers' but contains no UI or datatable code — only the loader and dropper — consistent with a typosquat/dependency-confusion carrier. No signature or hash verification is performed on the downloaded payload.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-datatable"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"f063976da0951c9ad21b07946e79d46c8038e5a1b8e11977c2b7d0a95b07c977","tlsh":"55a1a55a26fa301803a2e0e9852b5416719af65333c4d9d4fb0c66d44feb578c3b39ec"},{"path":"lib/telemetry.js","sha256":"77c6b7f4bddece3c047faf682b91229751e14f9722eebe5e878d69c0f60670cb","tlsh":"6f733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"},{"path":"package.json","sha256":"12c7e2674f6c95614f4c0011abff4549e750cbc780db177bfaabd23d0939e4e2","tlsh":"ffd02e380aa2983328c883130d16c49277309f6b10407c0c23cf682d03ae27379fb30d"}],"package_integrity":[{"filename":"dolyame-ui-datatable-35.8.1.tgz","hashes":{"sha1":"64c138c6842f38d1de5014d3de40aa9d3e1c0f0a","sha512_sri":"sha512-rIj1WImscw3puln2EWpwlQ0Djyp8KVMkMaO/wS9guMeHuAyzIVtbhqthnY/EovLC4Ms8agjQNVogzxJGGGsyvA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-datatable/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017035","import_time":"2026-08-07T12:51:23.099262295Z","modified_time":"2026-08-07T12:34:27Z","sha256":"730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33","source":"amazon-inspector","versions":["35.8.1"]}]}}