dolyame-ui-sortablelist

{"modified":"2026-08-07T12:30:51Z","published":"2026-08-07T12:30:51Z","schema_version":"1.7.4","id":"MAL-2026-13599","summary":"Malicious code in dolyame-ui-sortablelist (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7)\nOn require() the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf10{0..3}-*.workers.dev, host strings assembled by joining split literals to evade static analysis), with a fallback that reassembles a base64 payload from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The binary is written to a temp file disguised as OS diagnostics output ('dotnet_diag_<hex>.exe' on Windows, '.cache_<hex>' elsewhere), chmod'd 0755, and spawned detached and unref'd via cp.spawn('/bin/sh', ['-c', filePath+' &']). The same drop-and-exec logic is duplicated in lib/telemetry.js (the package's declared main), ensuring execution even if _bridge.js is bypassed. child_process is imported via string concatenation (require('child_'+'process')) and fs.chmodSync via bracket-access to further evade pattern scanning. The module self-labels as 'telemetry/analytics' and gates the drop on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables as a plausible-deniability cover; the actual behavior is fetch-and-execute of an attacker-controlled binary on the installer's host at import time.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-sortablelist"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"0d29d200ee9aebbe664ddb40d1d22a5be8e8180b8ea6e2abf0b1aa128c9c5ca4","tlsh":"dfa1855a1afe70180792e1d8452b5816719ee95333c4d8d4fb4ca6948f9a239c3b39fc"},{"path":"lib/telemetry.js","sha256":"63c17973060ce316cbf3c7309bfe94d30671fe68d2e253a76673a8671d1b0240","tlsh":"5073304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-sortablelist-35.8.1.tgz","hashes":{"sha1":"b72c0d66b8dac3dc3838cb0a35de688933717baf","sha512_sri":"sha512-uVG4ThZVciIgrsa0RJCF4kvOQLnrDW5O7YBD6U2LVoQVOEjz40ObpUG0k+SeZ6cPEUC3FW7/nrcYGDXEbwIRcA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-sortablelist/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017011","import_time":"2026-08-07T12:51:22.096019516Z","modified_time":"2026-08-07T12:30:51Z","sha256":"5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7","source":"amazon-inspector","versions":["35.8.1"]}]}}