dolyame-ui-inputphone

{"modified":"2026-08-07T12:31:27Z","published":"2026-08-07T12:31:27Z","schema_version":"1.7.4","id":"MAL-2026-13580","summary":"Malicious code in dolyame-ui-inputphone (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165)\nOn require() of the package, index.js loads _runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints (oob-worker.cf10x-*.workers.dev) with a DNS-TXT chunked fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Host strings are reconstructed at runtime via array-join (e.g. ['sdk.dl.wel1','.ru'].join('')) to evade static scans, and API references are split (child_'+'process, 'chmod'+'Sync'). The fetched bytes are written to a temp path with a cover-story filename (.cache_*, dotnet_diag_*.exe), chmod 0755 on Unix, and executed detached via cp.spawn('/bin/sh',['-c', filePath+' &']) or spawn('cmd',...) on Windows. No hash or signature verification is performed and the destinations are unrelated to the declared publisher. The package's own main export lib/telemetry.js, presented as a Sentry-like analytics SDK, wraps the same download/write/chmod/spawn primitives — the telemetry facade is cover for the dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inputphone"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"3de4dbb96d213b4bcce66690ca29c25d09b7221d5ac1d3da10ea6529bcce9db1","tlsh":"f7a1a55906fa70180393a4d4892f9416b19ff95332c4d9d0fb4cb6985fea13883b29fc"},{"path":"lib/telemetry.js","sha256":"4e90fa4f46019fb1b228e5026b5f708ef2bb943b5676b0169054d431a9a58912","tlsh":"cf73304966fb10214263b0685eab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-inputphone-35.8.1.tgz","hashes":{"sha1":"f9b26c6be8cecd9a0139fcaf94a393a05bb45b0b","sha512_sri":"sha512-OcpnzobvWUcmBeT7hBmHXnQZNpNizefej+hh6AMtTfUstX4pi037fI3zBS1IDRNB2sXo4r/QKelIHpw+9m/aMA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputphone/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017015","import_time":"2026-08-07T12:51:22.282399769Z","modified_time":"2026-08-07T12:31:27Z","sha256":"b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165","source":"amazon-inspector","versions":["35.8.1"]}]}}