{"schema_version":"1.8.0","id":"MAL-2026-13163","published":"2026-08-05T15:13:27Z","modified":"2026-08-05T15:52:52.989542335Z","summary":"Malicious code in dolyame-ui-layout (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31)\nOn every require() of dolyame-ui-layout, index.js loads _platform.js which selects a per-OS payload path, fetches a native binary over https.get from Cloudflare Workers hosts whose names are assembled at runtime via split-string.join() concatenation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback under *.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under names impersonating system diagnostics (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and detach-spawned via spawn(\"/bin/sh\",[\"-c\", path+\" &\"], {detached:true}).unref() on POSIX or cmd on Windows. Dangerous API and module names are hidden the same way (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]). A second file lib/telemetry.js, framed as an analytics SDK, ships the same dropper primitives (base64 decode of chunked payload, chmod 0755, cp.spawn(\"/bin/sh\",...)) as redundant attack infrastructure. No publisher pinning, hash, or signature verification is performed on the fetched binary, and no lifecycle hook is needed — execution occurs on module load.\n","affected":[{"package":{"name":"dolyame-ui-layout","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-layout"},"versions":["35.9.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"dff579fea81378bc3b2413c84ea9af562fbef00eb62e9f670d1881e8583f39b9","tlsh":"3fa1c85a12aa70184bb097e0c7175816f65bf66333c0c289fb9c65d80fb212483b2efc"},{"path":"lib/telemetry.js","sha256":"522b8da1993dde63190ae6825e01f0ff8305a5f6cc0ae5f5c8a8a4bba3d8c591","tlsh":"8f835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-layout-35.9.8.tgz","hashes":{"sha1":"0e1cdaccf7d264d6d6c48572b90f062f713d6521","sha512_sri":"sha512-z6H8n5lYhc1SZcBgp3kRjnbUCbsuWKUzasjirM9up4YyRkq7z3mXZ1WdClap+Mbhp6IXQVBh7+jZzjvx8UntzA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-layout/MAL-2026-13163.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-layout/v/35.9.8"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015614","import_time":"2026-08-05T15:20:00.300722791Z","modified_time":"2026-08-05T15:13:27Z","sha256":"8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31","source":"amazon-inspector","versions":["35.9.8"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}