dolyame-ui-tableinline

{"modified":"2026-08-07T12:26:27Z","published":"2026-08-07T12:26:27Z","schema_version":"1.7.4","id":"MAL-2026-13600","summary":"Malicious code in dolyame-ui-tableinline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8)\nOn require('dolyame-ui-tableinline'), index.js loads _init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors (hostnames reconstructed at runtime via string-array.join(\"\") to evade static matching), with a DNS TXT-record fallback to sdk.dl.wel1.ru. The binary is written to a disguised path under /tmp or %TEMP% (e.g., dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c \"<path> &\" or cmd /c start /b. A TTL marker file rate-limits re-execution. A second dropper (base64 buffer -> chmod 755 -> /bin/sh -c spawn) is duplicated inside lib/telemetry.js, the declared main module, wrapped in a fake SDK scaffold. Opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and cover-story file names (dotnet_diag_*,.analytics_state) are used as camouflage. The unpinned opaque native payloads, anonymous author-controlled hosts, obfuscated destination reconstruction, and detached background execution constitute full-host remote code execution on any machine that installs or imports the package.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-tableinline"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"207e3f177ee67d59c60af7328543acce487821caae99dc06089d8acae3e5c367","tlsh":"76a1745a15fb30180793e1d8851f9916719af6937384d584fb8ca6988fda12883f3aec"}],"package_integrity":[{"filename":"dolyame-ui-tableinline-35.8.1.tgz","hashes":{"sha1":"0d9e83b4fb7120141766d57a6d8df0b83ac025e5","sha512_sri":"sha512-Yi6VN2BvmHfCTc+nTl2FEcz9tj9bowSDn1DGSMTavknUA2Y3X93dJrrzvLRrOnDrVBuJy/ZFVcmYFv07ByMnHw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-tableinline/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016981","import_time":"2026-08-07T12:51:20.771578426Z","modified_time":"2026-08-07T12:26:27Z","sha256":"bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8","source":"amazon-inspector","versions":["35.8.1"]}]}}