dolyame-ui-selectaccount

{"modified":"2026-08-07T12:24:12Z","published":"2026-08-07T12:24:12Z","schema_version":"1.7.4","id":"MAL-2026-13598","summary":"Malicious code in dolyame-ui-selectaccount (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363)\nOn require() of the package, index.js loads _bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute dropper. The code selects a platform-tagged asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and fetches it from string-split, obfuscated hostnames of the form oob-worker.cf1XX-XXX.workers.dev, with a DNS-TXT chunked-base64 fallback over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under disguised names (.cache_<rand> or dotnet_diag_<rand>.exe), chmodded to 0755 via fs[\"chmod\"+\"Sync\"], and spawned detached with stdio ignored via cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"], { detached: true, stdio: \"ignore\" }).unref() or cmd.exe /c start /b. Dangerous API names are assembled at runtime by string concatenation (require(\"child_\" + \"process\")) and the destination hostnames are reconstructed with Array.join to hide the C2 from static inspection. The 'Analytics SDK' / 'telemetry' framing does not correspond to the code's actual behavior, which is unconditional retrieval and execution of an attacker-controlled native binary on the installer's host at import time. No integrity check, pinning, or signature verification is performed on the downloaded payload.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-selectaccount"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"9f357211560f752d5cd5b66c23973f779898903e21acf4b9dbcbd67b32364c1c","tlsh":"b3a1b61a12fb70284792e6d4851f5416729eea9332c4d8c4fb4c66548fa627983f39ec"},{"path":"lib/telemetry.js","sha256":"0bbc11d9fda2abf4cb0bef9746d7373532664280813b333e18305650bdbc9ccb","tlsh":"f373304966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-selectaccount-35.8.1.tgz","hashes":{"sha1":"c496a49d1d4e17a81ec362597c73a4008056178d","sha512_sri":"sha512-I7njemB0eaTnqtd/baavV7sZnuAKge+6jfKnhnHYZOQr9nk2ne4WXFKUUjh6SaDOMC+FxLhZ+qpbHPfPBJLGCA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-selectaccount/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016966","import_time":"2026-08-07T12:51:20.106027716Z","modified_time":"2026-08-07T12:24:12Z","sha256":"4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363","source":"amazon-inspector","versions":["35.8.1"]}]}}