dolyame-ui-inputfio

{"modified":"2026-08-07T12:32:00Z","published":"2026-08-07T12:32:00Z","schema_version":"1.7.4","id":"MAL-2026-13578","summary":"Malicious code in dolyame-ui-inputfio (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c)\nOn require() of the package, _adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments (oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, with DNS fallback to *.dl.wel1.ru), fetch an opaque binary payload over HTTPS (base64 chunked, with a DNS-TXT fallback path), write the bytes to /tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmod the file to 0755, and spawn it detached via /bin/sh -c or cmd. Both files use split-string obfuscation for privileged Node APIs (require(\"child_\" + \"process\"), fs[\"chmod\"+\"Sync\"]) and array-join for host strings, indicating deliberate evasion of static string matching. The main export lib/telemetry.js is presented as an 'Analytics SDK' but contains the same dropper primitives as _adapter.js. The behavior fires unconditionally when the package is imported.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inputfio"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"15ca6548884302f0e081c20e2afcfb9a46299833c915490468696bc559480826","tlsh":"6da1b65926fa30180793a1d8c52f8816719ff59333c8e984fb4c66944fd653883b2afc"},{"path":"lib/telemetry.js","sha256":"9f0f1e43a051b539c1fbc054cf0c6b851cbe02a139d1efa8fd8e7b59d7cd62e6","tlsh":"8a733f4966fb1021826370685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-inputfio-35.8.1.tgz","hashes":{"sha1":"54fe69c163aea595b911ce225deaf54d3e3bea6f","sha512_sri":"sha512-wNjbDO+pEq9EF/3SURug95ovb8vSvu59RgkXhgGT8h1pAlnSytl5OaPFJvC7HPtWWxc6tc0ppPdb/aj4GmR1qA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputfio/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017019","import_time":"2026-08-07T12:51:22.454038356Z","modified_time":"2026-08-07T12:32:00Z","sha256":"42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c","source":"amazon-inspector","versions":["35.8.1"]}]}}