dolyame-ui-memoizeweak

{"modified":"2026-08-07T12:27:12Z","published":"2026-08-07T12:27:12Z","schema_version":"1.7.4","id":"MAL-2026-13589","summary":"Malicious code in dolyame-ui-memoizeweak (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b)\nOn require of the package, index.js loads./_helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT covert-channel fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under cover names such as dotnet_diag_*.exe and.cache_*, chmodded 0755, and detach-spawned via cp.spawn('/bin/sh', ['-c', path + ' &'], {detached:true}). Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string fragments to evade static analysis (e.g. ['oob-work','er.cf9','9-9b3.workers.d','ev'].join(''), require('child_'+'process')). A second, redundant dropper path in lib/telemetry.js base64-decodes fetched chunks, writes an 'extension' file, chmods 0755, and spawns /bin/sh on the result under an 'Analytics SDK' framing. No version pinning, no hash or signature verification, no legitimate purpose consistent with the package's declared name.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-memoizeweak"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"26123b2246f9b9d4a50ad9cbd87b81ec6a46c15693d8be93664df535042c9dc5","tlsh":"66a1935526fe701807a3f4d5855f481a70aaf9933381d8d8fb4ca6984f9613883f2afc"},{"path":"lib/telemetry.js","sha256":"0718468f01c0902515c556d9cdb14d51d3c0ab36c1e0d53441885f4f42edc9bd","tlsh":"c4733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-memoizeweak-35.8.1.tgz","hashes":{"sha1":"1950da89e57eaf0103a4e8b94017e74d2300bc0d","sha512_sri":"sha512-PI/bmyffxW8JsdqBxFlaNacvFdOR0+5b//sQjDc5Ay3wL8uLn9M6WOb51CmcBu0N43cRHVc2XYCNVnQy+TCigg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-memoizeweak/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016986","import_time":"2026-08-07T12:51:21.010888704Z","modified_time":"2026-08-07T12:27:12Z","sha256":"89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b","source":"amazon-inspector","versions":["35.8.1"]}]}}