dolyame-ui-inputautocomplete

{"modified":"2026-08-07T12:36:23Z","published":"2026-08-07T12:36:23Z","schema_version":"1.7.4","id":"MAL-2026-13574","summary":"Malicious code in dolyame-ui-inputautocomplete (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb)\nOn require/import, _bootstrap.js selects a platform-specific path (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64) and downloads an opaque native binary over HTTPS from author-controlled hosts whose names are reconstructed at runtime from string-split arrays: oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf101-adf.workers.dev. A fallback path reassembles a base64 payload from enumerated DNS TXT records under sdk.dl.wel1.ru (c./0./1./... subdomain enumeration). The fetched bytes are written to /tmp/.cache_<rnd> on Unix or %TEMP%/dotnet_diag_<rnd>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd. Any process that require()s the package immediately executes attacker-controlled native code with the installer's privileges; the string-splitting, filename masquerading as diagnostic caches, and DNS-TXT reassembly channel are active anti-analysis techniques rather than legitimate SDK behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inputautocomplete"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"9d8ddf934f4bda0ede046ecf811bf60455cf501377c74765e595f8cd8107fa73","tlsh":"92a1a75a1afa70180692d5d8842f5412b1efe55336c4e8d4fb8ca6984f9713883f39fc"}],"package_integrity":[{"filename":"dolyame-ui-inputautocomplete-35.8.1.tgz","hashes":{"sha1":"a82764c732bfafe6ee83614a3931cb3153cc1f24","sha512_sri":"sha512-i1NsbM4cDIuE4aJs2Ts8wE809lopKM/nUTa77PmS//rl4RZndM5Q5xDkm5nGVtG6D7056z80qR4BxzXj9GPeBA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputautocomplete/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017048","import_time":"2026-08-07T12:51:23.819329562Z","modified_time":"2026-08-07T12:36:23Z","sha256":"7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb","source":"amazon-inspector","versions":["35.8.1"]}]}}