{"schema_version":"1.8.0","id":"MAL-2026-13160","published":"2026-08-05T15:13:35Z","modified":"2026-08-05T15:52:51.349422578Z","summary":"Malicious code in dolyame-ui-input (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242)\ndolyame-ui-input@35.7.6 is published as a React component library but ships no UI code. On require(), index.js loads _shim.js, which downloads a platform-specific binary from split-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). If HTTPS mirrors fail, the payload is reassembled from base64-encoded DNS TXT records across subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and passed through the same write+chmod+spawn path. Hostnames, module names (child_process, chmodSync), and paths are constructed by joining split fragments to defeat static analysis; comments falsely reference SHA-256 integrity checks though no verification is performed. A sibling module lib/telemetry.js contains parallel drop-and-execute logic (base64 buffer assembly, chmod 0755, spawn /bin/sh -c filePath+' &') though it is not currently on the require() path. Destinations are not publisher-controlled, the payload is unpinned and unverified, and execution is fully automatic on module load.\n","affected":[{"package":{"name":"dolyame-ui-input","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-input"},"versions":["35.7.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"13c7671160efaa652231096f6facdf510be17ec7fbc7de398c1ccaf7b1e31181","tlsh":"fea17496126a70098bb0dbe48b175416f69ff6633381c294fb5c69881f7752483b2dfc"},{"path":"lib/telemetry.js","sha256":"392b6b233aca576452208a3724db64e900f6e32d1f3cff3ddb6784f6cc8bdb8b","tlsh":"0c835056566a502186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-input-35.7.6.tgz","hashes":{"sha1":"c824ad22e662528a700c3235e31e6947a05047c2","sha512_sri":"sha512-EeB2wOQi7J6SCA+piRnDfTG0TzsmbkQCreoHP6YEwMfROoblb3d+W+9Ud8CZHurR+Ou4d2KtBmZPa2fGY5eXUQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-input/MAL-2026-13160.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-input/v/35.7.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015615","import_time":"2026-08-05T15:20:00.333143334Z","modified_time":"2026-08-05T15:13:35Z","sha256":"a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242","source":"amazon-inspector","versions":["35.7.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}