dolyame-ui-inputtime

{"modified":"2026-08-07T12:27:04Z","published":"2026-08-07T12:27:04Z","schema_version":"1.7.4","id":"MAL-2026-13586","summary":"Malicious code in dolyame-ui-inputtime (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5)\nOn require('dolyame-ui-inputtime'), index.js loads./_loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts (oob-worker.cf101-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev), with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): dns.resolveTxt is used to fetch a chunk count and base64-encoded payload chunks that are concatenated and decoded. The fetched bytes are written to /tmp or %TEMP% under masquerade names (.cache_<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c '<path> &' or cmd /c start, with.unref() to survive the parent process. Hostnames are reconstructed at runtime from array.join to evade static analysis, and dangerous APIs are resolved via string concatenation (require('child_' + 'process'), fs['chmod' + 'Sync']). The same dropper logic is duplicated in lib/telemetry.js under an SDK_NAME='apm.node' cover. Manifest name and description ('Monitoring and observability SDK') do not match the shipped behavior; the package name has no relation to the code.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-inputtime"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"138c603c0772c63a490127e389f1a6b113f88254368259ad429971885ca78731","tlsh":"fba1c5591bfa30284792e5d8891f4816719ef5833285d8d4fb4c2a948fe7124c3b39fc"},{"path":"package.json","sha256":"cf2a14adbc7c47b605161a208c4e5f801ed65a4973c7b66edc8da41834dcb338","tlsh":"07d05b344f62952316c056671d26d58273509fab10457c0817cf152c028e6775dfb36d"}],"package_integrity":[{"filename":"dolyame-ui-inputtime-35.8.1.tgz","hashes":{"sha1":"3f54258fe1333ace26b4e11edeff22c4139bedfb","sha512_sri":"sha512-Xwi7K1XDA/O3Ra4JXg8o5P9Nrwg7PMxOVDsnjG8iP89qqpMsswrHF2B+9rJRBWGROrFcqWW7QVTgoW1OYmr2/A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputtime/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016985","import_time":"2026-08-07T12:51:20.966919646Z","modified_time":"2026-08-07T12:27:04Z","sha256":"19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5","source":"amazon-inspector","versions":["35.8.1"]}]}}