dolyame-ui-overridestyles

{"modified":"2026-08-07T12:26:01Z","published":"2026-08-07T12:26:01Z","schema_version":"1.7.4","id":"MAL-2026-13591","summary":"Malicious code in dolyame-ui-overridestyles (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72)\nOn require() of the package, `_compat.js` invokes a setup() routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked-base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a cover-named file under TMP or /var/tmp (e.g., dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. A second dropper path in lib/telemetry.js (loaded via the package `main`) reconstructs an executable from base64 buffers, chmods 0755, and spawns via /bin/sh. Hostnames, the `child_process` require, and `chmodSync` are constructed by concatenation to evade static scanners. No hash or signature verification is performed on the downloaded payloads. The purpose is inconsistent with the package's presented name (a UI style-override library).\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-overridestyles"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"62f81fca34889e93a5c29b6f461392c8095253882ca78338ea473cf90bcf7db4","tlsh":"1ea1b75a06fa70180792a4d9852b5806b19ff95336c4d9c0fb4ca6a44faa13883b39fc"},{"path":"lib/telemetry.js","sha256":"befc06df96ce12a8224293d76e7c13caa0e160abe3b32a3036377d516fe6c8da","tlsh":"4f733f4966fb10214263b0685eab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-overridestyles-35.8.1.tgz","hashes":{"sha1":"294bece243b24fd2e0d2f99ad04ef41d1faba520","sha512_sri":"sha512-DvVw6jtK5rCIijvUnms/7p+ssc1B8++++T5stxNC2/AeI+qBJmU/9iPFr4VMBLO3WHCIaKx4kftoiQ4gHAPpog=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-overridestyles/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016978","import_time":"2026-08-07T12:51:20.663868189Z","modified_time":"2026-08-07T12:26:01Z","sha256":"38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72","source":"amazon-inspector","versions":["35.8.1"]}]}}