dolyame-ui-inputtag

{"modified":"2026-08-07T12:34:08Z","published":"2026-08-07T12:34:08Z","schema_version":"1.7.4","id":"MAL-2026-13585","summary":"Malicious code in dolyame-ui-inputtag (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8)\nOn require of the package's main entry, index.js loads _init.js which downloads a platform-specific executable from hardcoded oob-worker.*.workers.dev endpoints, with a DNS-TXT chunked fallback over *.dl.wel1.ru sub-domains (sdk/ext/pkg/net.dl.wel1.ru). The fetched binary is written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Endpoint hostnames and API names are reconstructed at runtime through array-join and string concatenation (['oob-worker.','cf103-070.worker','s.de','v'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static scanners. A second dropper path with the same shape is present in lib/telemetry.js, loaded via the package main. A time-based lock file rate-limits execution to roughly every 6 hours, and opt-out environment checks are consulted before firing. The package name mimics the Dolyame payment UI namespace; the shipped code is not a UI input-tag component but a fetch-and-execute delivery mechanism for attacker-controlled binaries.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inputtag"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"798c56493e43c7763788a405aec877ef0d509bbccf46f149fba2b36aff0dba61","tlsh":"50a1a55a1afa70180793e4d8855f4416719af69333c4e9d8fb4c76845f9b238c3b29ec"},{"path":"lib/telemetry.js","sha256":"d5ea368c227a77e5b76697595cd18853582c7ecf8303f18f64541680beb87184","tlsh":"a0733f4966fb10214263b0685fab40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-inputtag-35.8.1.tgz","hashes":{"sha1":"008d7c31a35abfb9fafefc516ae3fe1b154108c3","sha512_sri":"sha512-OdZgwl6gg9PEUQOa5w6n0VSKjC3yMQ29k85tQBApNI+LstvLqemOPUms6qs5lv9Nq9ZGV/2+fDiLJoY7bnj2LQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputtag/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017033","import_time":"2026-08-07T12:51:22.985461944Z","modified_time":"2026-08-07T12:34:08Z","sha256":"b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8","source":"amazon-inspector","versions":["35.8.1"]}]}}