dolyame-ui-noindex

{"modified":"2026-08-07T12:24:50Z","published":"2026-08-07T12:24:50Z","schema_version":"1.7.4","id":"MAL-2026-13590","summary":"Malicious code in dolyame-ui-noindex (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e)\nOn require(), index.js loads./_ext which selects a platform-specific payload (linux_x64/arm64, darwin, win32), downloads an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru hosts whose names are reconstructed from split string arrays, writes it to /tmp or the Windows temp directory under a disguised name (a hidden.cache_<hex> file or a dotnet_diag_<hex>.exe lookalike), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-based fallback channel reassembles base64 payload chunks from numbered subdomains of ext.dl.wel1.ru / sdk.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru when HTTPS is blocked. The same drop-and-exec routine is duplicated in lib/telemetry.js, where the child_process require is also split-string obfuscated. The package name resembles a legitimate UI library but the shipped code contains no such library — its only import-time effect is to fetch and execute an opaque remote binary.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-noindex"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"a0a624f60f7b065be242ef2530a5e8b1f2f139476682ee0c9e18b6ab079e65b9","tlsh":"29a1955926fa30180792a1d4851f982671defa9333c5d8c4fb4ca5985f9b138c3f2aec"}],"package_integrity":[{"filename":"dolyame-ui-noindex-35.8.1.tgz","hashes":{"sha1":"733ed410706f41dea03c12f80cec20e9d07415b1","sha512_sri":"sha512-JnuGk0x83Xv5abjO0jzyQ6SJZc9nicFswh270ik1AiUJ2+0Vl85xvVPuG+QsVA3+NAOCyjKNsYy7ds6dxyBCJA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-noindex/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016970","import_time":"2026-08-07T12:51:20.318696661Z","modified_time":"2026-08-07T12:24:50Z","sha256":"dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e","source":"amazon-inspector","versions":["35.8.1"]}]}}