dolyame-ui-mediainfohoc

{"modified":"2026-08-07T12:28:53Z","published":"2026-08-07T12:28:53Z","schema_version":"1.7.4","id":"MAL-2026-13588","summary":"Malicious code in dolyame-ui-mediainfohoc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf)\nOn require of the package, _platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf103-070) with a DNS-TXT fallback resolution via *.dl.wel1.ru subdomains (pkg.dl.wel1.ru, ext.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or %TEMP% under a hidden dotfile or.exe name, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start. Host strings are split across.join() arrays and API names are concatenated (\"chmod\"+\"Sync\", \"child_\"+\"process\") to evade static matching; comments falsely label the behavior as 'telemetry'. A duplicate dropper is embedded in lib/telemetry.js (the package main) wrapped in a fake Sentry-style analytics SDK, decoding a base64 buffer, writing it to disk, chmod 0755, and spawning /bin/sh -c '<path> &' — reachable via require('dolyame-ui-mediainfohoc') even if _platform.js is not directly loaded. The package name mimics an unrelated UI helper but ships two independent copies of the same fetch-and-execute backdoor.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-mediainfohoc"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"db08033ff67ea25d8c22c0f2be0bc9605c48e221b52883ba80180e9a3fd89677","tlsh":"0ea1d64916fa30180393b5d4851f581671aaf5833384d998fb4c67945fea278c3b3aec"},{"path":"lib/telemetry.js","sha256":"9cb9e5b52cdfbd30eb55f7aa174b2ed0ff15e9d53e600fec7aae600a406f1217","tlsh":"f6733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-mediainfohoc-35.8.1.tgz","hashes":{"sha1":"84d911043b1c3370818f990c533a32e65178c6b3","sha512_sri":"sha512-fInv/yRKUsOg5qm3IxMTAvSA26a43j5jp+kp4duWwjdIuX27m8vFjPXmnZdacc3Rhi0bemDJr4T1astGatkgug=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-mediainfohoc/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016998","import_time":"2026-08-07T12:51:21.54633269Z","modified_time":"2026-08-07T12:28:53Z","sha256":"e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf","source":"amazon-inspector","versions":["35.8.1"]}]}}