dolyame-ui-draghoc

{"modified":"2026-08-07T12:25:05Z","published":"2026-08-07T12:25:05Z","schema_version":"1.7.4","id":"MAL-2026-13567","summary":"Malicious code in dolyame-ui-draghoc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955)\nOn require(), index.js loads _loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled at runtime via array joins (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), writes it to a hidden temp file (/tmp/.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. A DNS-TXT covert-channel fallback under sdk.dl.wel1.ru concatenates numbered TXT records and base64-decodes them into the payload buffer to bypass HTTP-URL blocklists. A parallel dropper exists in lib/telemetry.js reachable from the package's main entry, using dynamic property access (fs['chmod'+'Sync'], require('child_'+'process')) as anti-analysis obfuscation and following the same fetch->chmod->detached spawn pattern. No signature or hash verification is performed on the downloaded binary. The package advertises itself as core infrastructure utilities but ships only a binary retriever.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-draghoc"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"098fd23b610ee5358bdf1276da08725ba79cc6281c0291ceca2b46fa94f49690","tlsh":"efa1a55a16fa30180793e5d4891b4416719ff9433284d9c8fb4ca6988f96229c3b39fc"},{"path":"lib/telemetry.js","sha256":"88fe62217e6e518f7e608a9b629256de414ea83e397d45e33c2a7aef073337f9","tlsh":"a473304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-draghoc-35.8.1.tgz","hashes":{"sha1":"8db023153be6a66881534ff4097ffae893279f20","sha512_sri":"sha512-V5oZyHIRGJXA6pGvs/5KuUJDuxpDWBHI3xzS+cqr6EsFDrey3YkcmurXu20Fsj7gAFsCo0Uam10ZHVNRFmZe2g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-draghoc/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016972","import_time":"2026-08-07T12:51:20.439919895Z","modified_time":"2026-08-07T12:25:05Z","sha256":"9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955","source":"amazon-inspector","versions":["35.8.1"]}]}}