{"schema_version":"1.8.0","id":"MAL-2026-13135","published":"2026-08-05T15:18:24Z","modified":"2026-08-05T15:52:40.080438980Z","summary":"Malicious code in dolyame-ui-avatar (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e)\nOn package load, index.js requires./_platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with DNS-TXT fallback resolvers under *.dl.wel1.ru (sdk/ext/pkg/net). Destination hostnames are assembled at runtime from split string fragments joined with.join('') to evade static analysis. The fetched payload is written to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A marker file.analytics_state is written to throttle re-execution. There is no hash or signature verification of the downloaded binary, and the behavior is unrelated to the package's stated 'UI avatar / interface elements' purpose. The package name mimics the legitimate dolyame payment SDK ecosystem.\n","affected":[{"package":{"name":"dolyame-ui-avatar","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-avatar"},"versions":["35.9.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"ca0cc95a512f6bf5a71fdf9f3e6508a50d344f600595eefa8707032a41414dbf","tlsh":"05b18696126a70094fb0d7e4c72b9816f55af6633b81c288f75c55985f7302483b2dfc"}],"package_integrity":[{"filename":"dolyame-ui-avatar-35.9.8.tgz","hashes":{"sha1":"b96679c95349f4d0104e0fa3fa98ab643ff3edcc","sha512_sri":"sha512-r2XxSB8DmUZIpfBGRl2sLmBTnTnX5U+RIeoWujIxInISGOpc4ij0mvx0Yld/viO3L3zWEgEtJ+hHH0FGSOZETA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-avatar/MAL-2026-13135.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-avatar/v/35.9.8"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015646","import_time":"2026-08-05T15:20:01.4505189Z","modified_time":"2026-08-05T15:18:24Z","sha256":"3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e","source":"amazon-inspector","versions":["35.9.8"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}