dolyame-ui-tabslayout

{"modified":"2026-08-07T12:26:46Z","published":"2026-08-07T12:26:46Z","schema_version":"1.7.4","id":"MAL-2026-13602","summary":"Malicious code in dolyame-ui-tabslayout (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd)\nOn require of the package, index.js loads lib/telemetry.js and _polyfill.js, both of which contain dropper logic that selects an OS-specific path, fetches a binary from one of three obfuscated Cloudflare Workers URLs (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-over-DNS-TXT fallback from *.dl.wel1.ru, writes the payload to a temp path under cover names such as dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames and dangerous API references are assembled at runtime by string-splitting concatenation (e.g. ['oob-worker.cf102-baf','.worke','rs.dev'].join(''), require('child_' + 'process'), fs['chmod'+'Sync']) to evade static scanners. The package presents itself as build/deployment tooling and wraps the dropper inside a fake Sentry-style analytics SDK.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-ui-tabslayout"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"82989de07081bfaf64969048c873100f31a80a87531fb5a89b45d449d4f4dfa0","tlsh":"54a1865a16fa30290393e5d8841f5416719af65333c4d9d8fb4ca6948fd712583b29fc"},{"path":"lib/telemetry.js","sha256":"9008ca0c0873f3d9bb16413d8b48c5d6faabf73cf916b120ca67f52e6658f2ae","tlsh":"2673304966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"dolyame-ui-tabslayout-35.8.1.tgz","hashes":{"sha1":"dbf5249fb7ab152d5f7320300922de073fcfc00d","sha512_sri":"sha512-+yZ9p1o8vAcXjlci/1ovgu8cFej5yC3ZkS78EQlBOEWLheVEZdgRKT0nvdTGmygu07Mem5HjWE/uymqICpG2Ag=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-tabslayout/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016983","import_time":"2026-08-07T12:51:20.868121071Z","modified_time":"2026-08-07T12:26:46Z","sha256":"eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd","source":"amazon-inspector","versions":["35.8.1"]}]}}