{"schema_version":"1.8.0","id":"MAL-2026-13190","published":"2026-08-05T15:08:59Z","modified":"2026-08-05T15:53:05.481654659Z","summary":"Malicious code in dolyame-ui-tabs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4beccb0ba046e54873e7d6af1d2023eb5f01a0eab4ed5abe336de2e3e3a74993)\nindex.js requires./_support, whose top-level run() fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (reconstructed via array.join() such as ['oob-worker.cf102-baf.','worker','s.','dev']) with a DNS-TXT chunked base64 fallback channel served from *.dl.wel1.ru resolver hosts (e.g. ['sd','k.dl.wel','1.','ru'].join('')). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755'd on POSIX, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution fires on require() of the package, giving arbitrary remote code execution on the installer's host at library-load time. The package is advertised as a React components/tabs library and has no legitimate need for a native binary or DNS-TXT payload channel. lib/telemetry.js contains a structurally identical dormant dropper (HTTPS + DNS discovery, chunk decoding, chmod 755, /bin/sh spawn) that is not reached from the current entry point but ships in the tarball. Hostname reconstruction, disguised drop filenames, and telemetry-styled opt-out env vars indicate deliberate evasion.\n","affected":[{"package":{"name":"dolyame-ui-tabs","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-tabs"},"versions":["35.3.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"a53066b9894e467dd6951a223e27fd89b144a6f84f2557f55f29e0216de18095","tlsh":"aaa1b89a06aa701887b1dbe487174415f66be6633780c1d4f75ca5981fb713483b2efc"},{"path":"lib/telemetry.js","sha256":"f37f2753bfb90ad95542c106e9e14daca4ce7c8dfc2e0d11d150068dd67d0241","tlsh":"3d835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-ui-tabs-35.3.2.tgz","hashes":{"sha1":"7a31373cf176f2ef237aaa0859ada7e8e590046a","sha512_sri":"sha512-p/pS4jXWRGkTfYqTsaNVCWaYH6QJxgPm0hqJ+A11oNN3Uv63i6AVhtsfggAWbUgGSh943SSkbNYwzK+pRJoGwA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tabs/MAL-2026-13190.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-tabs/v/35.3.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015585","import_time":"2026-08-05T15:19:59.233516943Z","modified_time":"2026-08-05T15:08:59Z","sha256":"4beccb0ba046e54873e7d6af1d2023eb5f01a0eab4ed5abe336de2e3e3a74993","source":"amazon-inspector","versions":["35.3.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}