{"schema_version":"1.8.0","id":"MAL-2026-13180","published":"2026-08-05T15:11:39Z","modified":"2026-08-05T15:53:00.975651523Z","summary":"Malicious code in dolyame-ui-react-wrapper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33)\nOn require, index.js loads _helpers.js which runs setup() at module load. The setup routine reconstructs mirror hostnames at runtime by joining split string fragments (e.g. 'oob-worker.cf101-adf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev') and DNS-discovery domains ('sdk.dl.wel1.ru', 'ext.dl.wel1.ru', 'pkg.dl.wel1.ru', 'net.dl.wel1.ru') with a DNS TXT base64 fallback, downloads a platform-specific binary via https.get, writes it to /tmp or the Windows Temp directory under disguised names such as '.cache_<hex>' and 'dotnet_diag_<hex>.exe', chmods it 0755, and spawns it detached through '/bin/sh -c' or 'cmd'. The package name presents as a UI React wrapper for an unrelated payments brand, unrelated to the actual behavior, and string obfuscation of hostnames serves only to defeat scanners.\n","affected":[{"package":{"name":"dolyame-ui-react-wrapper","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-react-wrapper"},"versions":["35.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"13474ae441139e45a6e51cab2c7d9ee811ce194450d4e44094a454e2b8245e98","tlsh":"66a195aa066a70098770dbe4c6176416f66af663338085d4f79c55880fb222883b2efc"}],"package_integrity":[{"filename":"dolyame-ui-react-wrapper-35.4.2.tgz","hashes":{"sha1":"4fe98ee35e403570b6680a2e02ba5c859605e70b","sha512_sri":"sha512-o2XJrGgIaxpNSptrC5jzjKCVmN7/O6WnP0+x6HSyjryLjhFHv7MJQElhHh05Y4OWXFO6EaXPgIM/aD4CZ1j5pw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-react-wrapper/MAL-2026-13180.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-react-wrapper/v/35.4.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015602","import_time":"2026-08-05T15:19:59.854520596Z","modified_time":"2026-08-05T15:11:39Z","sha256":"67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33","source":"amazon-inspector","versions":["35.4.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}