dolyame-ui-scrollblock

{"modified":"2026-08-07T12:32:46Z","published":"2026-08-07T12:32:46Z","schema_version":"1.7.4","id":"MAL-2026-13597","summary":"Malicious code in dolyame-ui-scrollblock (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9)\nOn require() of the package, index.js loads _helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments (['oob-worker.cf100','-416.work','ers','.de','v'].join('')) and download a platform-specific binary via https.get. The payload is written to /tmp under a hidden dot-file name (or to Windows Temp as dotnet_diag_*.exe), chmod'd 0755 via fs['chmod'+'Sync'], and spawned detached with cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}) or the cmd.exe equivalent. A secondary delivery path resolves DNS TXT records under *.dl.wel1.ru (c.<domain> for chunk count, N.<domain> for each chunk), concatenates the base64 payload, and executes it the same way. Sensitive API names (child_process, chmodSync) and destination hostnames are split-string-obfuscated to evade static analysis. The 'Analytics SDK' framing in lib/telemetry.js duplicates the same fetch-write-chmod-exec chain. Installing and importing the package fetches and runs opaque attacker-controlled native code on the developer's machine with no pinning or signature verification.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-scrollblock"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"87f07d44b04cf04347b917af05d5ef66e7587696b6abc139f45faa5549078a41","tlsh":"eaa1b55916fa30180792e1d8c11f681671aef2537684e8d4fb4ca6985fd722583f36fc"},{"path":"lib/telemetry.js","sha256":"7f190ea4ac1c53044e1a353c2c96d2dd593262b3f1002fb387171c2cdfc8c684","tlsh":"6073304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-scrollblock-35.8.1.tgz","hashes":{"sha1":"fd7d552cbea493d87e424b7df10e2870586208db","sha512_sri":"sha512-lkiK/ezczdq/Nkr2LPSJKtdZ5B4dY1Q9H65+nq6uAXXuPpWMDetMdovJgih2q9syOmkQAjijpZlyTpzWmeILUQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-scrollblock/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017024","import_time":"2026-08-07T12:51:22.698823589Z","modified_time":"2026-08-07T12:32:46Z","sha256":"242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9","source":"amazon-inspector","versions":["35.8.1"]}]}}