{"schema_version":"1.8.0","id":"MAL-2026-13164","published":"2026-08-05T15:12:44Z","modified":"2026-08-05T15:52:53.466100913Z","summary":"Malicious code in dolyame-ui-link (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a)\nindex.js requires./_loader on load. _loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join(\"\") to yield Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev and oob-worker.cf102-baf.workers.dev, and a DNS-TXT fallback channel under subdomains of wel1.ru. It HTTPS-GETs a platform-specific binary (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), writes it to /var/tmp/.cache_<hex> or %TEMP%\\dotnet_diag_<hex>.exe under a disguised filename, chmods 0755, and spawns it detached via /bin/sh -c \"<path> &\" or cmd.exe /c start /b. lib/telemetry.js carries the same drop-and-exec primitives under an \"analytics SDK\" cover story. Fires automatically on require of the package, giving arbitrary native code execution on the installer's host.\n","affected":[{"package":{"name":"dolyame-ui-link","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-link"},"versions":["35.8.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"279d685a3800ff286bb9323c0a55126843f51e6b7f09a8f5a9a5a8df08feb687","tlsh":"a1b1a896166a70184bb09be5c7179415f59bfa6337c0c184fb9ca5d91f7202883b2efc"},{"path":"lib/telemetry.js","sha256":"299f6eb7d2e09fe9b0168194a061418106bbb65e65b8862422257f5e15bfd437","tlsh":"64835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-link-35.8.5.tgz","hashes":{"sha1":"0cbfcf2d219e125e3a4a2b93eb288cb471619cda","sha512_sri":"sha512-UXWOrW+H1RxTfD87nRBgV1YCDkRNx7BphV6DPVu19o4AY/o50LSQYaAqwrygaobpJwtunlAuWiuP/+WdDEyA0A=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-link/MAL-2026-13164.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-link/v/35.8.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015609","import_time":"2026-08-05T15:20:00.139255415Z","modified_time":"2026-08-05T15:12:44Z","sha256":"26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a","source":"amazon-inspector","versions":["35.8.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}