{"id":"MAL-2026-13133","summary":"Malicious code in dolyame-ui-accordion (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637)\nThe package is advertised as a React accordion UI component but on require() unconditionally loads _vendor.js, which downloads a platform-specific binary from obfuscated Cloudflare workers.dev endpoints (with a DNS TXT-record base64 fallback via *.wel1.ru), writes it to /tmp or %TEMP% under disguised names (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime from split string fragments (e.g. [\"oob-worker.cf99-9b3.workers\",\".dev\"].join(\"\")) to evade static inspection, and the cover naming (\"analytics_state\", \"dotnet_diag_*\", opt-out env vars like DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the flow as diagnostics. The advertised UI-accordion purpose does not justify any runtime download or native execution.\n","modified":"2026-08-05T15:52:38.800929276Z","published":"2026-08-05T15:18:17Z","database_specific":{"malicious-packages-origins":[{"sha256":"9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637","source":"amazon-inspector","versions":["35.2.6"],"id":"IN-MAL-2026-015645","import_time":"2026-08-05T15:20:01.421356614Z","modified_time":"2026-08-05T15:18:17Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-accordion/v/35.2.6"}],"affected":[{"package":{"name":"dolyame-ui-accordion","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-accordion"},"versions":["35.2.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-accordion/MAL-2026-13133.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"c7fc1866a62f1bcc88d206157c8eeee772b13cb9","sha512_sri":"sha512-o/Pg1iMDwA8VJd6wSvbvrd4SlEY29iUGr2MFSxYHEkuogirJG18EJiXtOs9Q6Q8+gWhTCn/sZjte0hbDzCQvzA=="},"filename":"dolyame-ui-accordion-35.2.6.tgz"}],"evidence_files":[{"path":"_vendor.js","sha256":"fde4ea5a6988e7b2b744158771ff8fbf315c270021462b7bc3e55771feb7f0a6","tlsh":"efa175aa166670188770d7e4c6176415f65af6637780c2d8f79c69980ff312482b2efc"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}