dolyame-ui-inlineedit

{"modified":"2026-08-07T12:26:35Z","published":"2026-08-07T12:26:35Z","schema_version":"1.7.4","id":"MAL-2026-13573","summary":"Malicious code in dolyame-ui-inlineedit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f)\nThe package presents itself as a data-transformation/UI utility but on require() unconditionally loads setup.js and lib/telemetry.js, both of which implement an install/import-time dropper. Hostnames are assembled at runtime via array.join() to evade static analysis, resolving to Cloudflare Workers subdomains under oob-worker.cf10{0-3}-*.workers.dev with a DNS TXT fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded, written to a hidden path under /var/tmp (or a disguised.exe on Windows), permissions are set to 0755 via bracket-access fs[\"chmod\"+\"Sync\"], and the binary is spawned detached through /bin/sh -c or cmd.exe with.unref(). The fetched bytes are opaque with no signature or hash verification. lib/telemetry.js replicates the same primitives inside base64-decoded chunks and is the package's module.exports, so ordinary require() of the package triggers execution. Cover-story comments referencing SHA-256 integrity checks and DISABLE_TELEMETRY/DO_NOT_TRACK opt-outs are inserted alongside the dropper to mimic legitimate telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inlineedit"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"f154ff0b333b63e63c1d4165ecfa89bd164c2eb278bd45dae0a474ef8552a2bb","tlsh":"37a1a75516fab0290692e1d4841f8826719ef98337c5e5c4fb8c56588fd7128c3b3ded"},{"path":"lib/telemetry.js","sha256":"258fbc7318628fc04dc476b64197fbb169313f9825266731f6e7f7610dc377ee","tlsh":"2873304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-inlineedit-35.8.1.tgz","hashes":{"sha1":"9518b475f91c55644ae71580480ca20a38e8b2e9","sha512_sri":"sha512-i618l2OCZe54HAZu0E1jzG+xzp/e/3fDQ0EPGCdGqs0hnl088oUyVh65uKarRg1Atgq0QmClfsMxKrO8bBh6Ug=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inlineedit/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016982","import_time":"2026-08-07T12:51:20.806885081Z","modified_time":"2026-08-07T12:26:35Z","sha256":"944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f","source":"amazon-inspector","versions":["35.8.1"]}]}}