{"id":"MAL-2026-13142","summary":"Malicious code in dolyame-ui-chart (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9)\nOn require() of the package, index.js loads _shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The fetched bytes are written to a temp path under decoy names (e.g. dotnet_diag_\u003crand\u003e.exe,.cache_\u003crand\u003e), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Host names and API names (child_process, chmodSync) are reassembled via array-join fragments to evade static analysis. A secondary dropper with equivalent base64-decode + chmod 755 + spawn '/bin/sh -c \u003cfile\u003e &' logic is bundled in lib/telemetry.js (~81KB) under an 'analytics SDK' cover story. Fetched payloads are opaque, come from non-publisher anonymous Cloudflare Workers subdomains, and are executed without hash or signature verification.\n","modified":"2026-08-05T15:52:43.337916772Z","published":"2026-08-05T15:16:17Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015632","import_time":"2026-08-05T15:20:01.020726018Z","modified_time":"2026-08-05T15:16:17Z","sha256":"d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9","source":"amazon-inspector","versions":["35.7.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-chart/v/35.7.2"}],"affected":[{"package":{"name":"dolyame-ui-chart","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-chart"},"versions":["35.7.2"],"database_specific":{"indicators":{"package_integrity":[{"filename":"dolyame-ui-chart-35.7.2.tgz","hashes":{"sha1":"2a56bb6834be77beb0f6189d73b0cfda64fb44c5","sha512_sri":"sha512-o7cFk60lJxTGQw1yOygsFlooVg4q77e+vp5woo6iN53bZTdvtsQkvMDU3v6O8DJEr4dup0bNQPenerjkViDERg=="}}],"evidence_files":[{"sha256":"f2f475168e9355b3e22cde00106ba672e4daa181676148283d349db906edac94","tlsh":"dca1959a05aa70198bb0a7f48717441af65bf6633380c298f75ca9985f735248372efc","path":"_shim.js"},{"tlsh":"99835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"e2556477ce6bb35d9247938c085879402441254c1f354709ccb2c605150e9f35"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-chart/MAL-2026-13142.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}