dolyame-ui-generateid

{"modified":"2026-08-07T12:23:57Z","published":"2026-08-07T12:23:57Z","schema_version":"1.7.4","id":"MAL-2026-13571","summary":"Malicious code in dolyame-ui-generateid (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf)\nOn require() of the package, index.js loads _shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev, with a covert DNS TXT-record fallback that reads chunk counts from c.<domain> and base64 payload fragments from N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under disguised names such as.cache_<rand> or dotnet_diag_<rand>.exe, chmodded 0755 on POSIX, and spawned detached via /bin/sh -c \"<path> &\" or cmd.exe /c start. A second import-reachable dropper path exists in lib/telemetry.js: it decodes base64 chunks into a Buffer, invokes fs[\"chmod\"+\"Sync\"] with mode 0o755, and calls cp.spawn(\"/bin/sh\", [\"-c\", filePath+\" &\"]). Anti-analysis techniques include split-string require(\"child_\"+\"process\"), split-property fs[\"chmod\"+\"Sync\"], array-join hostname assembly, and DNS TXT-record staged payload delivery. The package's stated purpose (a UI ID-generation helper / observability SDK) does not require fetching and executing native binaries from anonymous Cloudflare Workers domains.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-generateid"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"f17a9dd050c9f8563680b48802201182fb2d3b4d30581adac1a086f34c489370","tlsh":"8ba1865916fa70180792e5d8841f9416b19be69332c4e8c4fb4c6a948fe7279c3b39fc"},{"path":"lib/telemetry.js","sha256":"2ab911b995b44d63d9e9e224253e743f05c1ff041b1c8fc4570b340deb8f1825","tlsh":"ab733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-generateid-35.8.1.tgz","hashes":{"sha1":"43c8cde7143e1bafbab501aa85c2ea285fa2b98f","sha512_sri":"sha512-Efj5Fuwwn6NX+4anH6geec4p4LJ4kcj5OwxXk9RvgUcGg8asu9IydKM+7FwNLxUouzrcZf2S52VIfUlKYhYvGA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-generateid/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016964","import_time":"2026-08-07T12:51:20.041775734Z","modified_time":"2026-08-07T12:23:57Z","sha256":"1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf","source":"amazon-inspector","versions":["35.8.1"]}]}}