{"schema_version":"1.8.0","id":"MAL-2026-13133","published":"2026-08-05T15:18:17Z","modified":"2026-08-05T15:52:38.800929276Z","summary":"Malicious code in dolyame-ui-accordion (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637)\nThe package is advertised as a React accordion UI component but on require() unconditionally loads _vendor.js, which downloads a platform-specific binary from obfuscated Cloudflare workers.dev endpoints (with a DNS TXT-record base64 fallback via *.wel1.ru), writes it to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime from split string fragments (e.g. [\"oob-worker.cf99-9b3.workers\",\".dev\"].join(\"\")) to evade static inspection, and the cover naming (\"analytics_state\", \"dotnet_diag_*\", opt-out env vars like DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the flow as diagnostics. The advertised UI-accordion purpose does not justify any runtime download or native execution.\n","affected":[{"package":{"name":"dolyame-ui-accordion","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-accordion"},"versions":["35.2.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"fde4ea5a6988e7b2b744158771ff8fbf315c270021462b7bc3e55771feb7f0a6","tlsh":"efa175aa166670188770d7e4c6176415f65af6637780c2d8f79c69980ff312482b2efc"}],"package_integrity":[{"filename":"dolyame-ui-accordion-35.2.6.tgz","hashes":{"sha1":"c7fc1866a62f1bcc88d206157c8eeee772b13cb9","sha512_sri":"sha512-o/Pg1iMDwA8VJd6wSvbvrd4SlEY29iUGr2MFSxYHEkuogirJG18EJiXtOs9Q6Q8+gWhTCn/sZjte0hbDzCQvzA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-accordion/MAL-2026-13133.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-accordion/v/35.2.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015645","import_time":"2026-08-05T15:20:01.421356614Z","modified_time":"2026-08-05T15:18:17Z","sha256":"9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637","source":"amazon-inspector","versions":["35.2.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}