{"id":"MAL-2026-13143","summary":"Malicious code in dolyame-ui-checkable (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c)\nindex.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of Cloudflare workers.dev mirror hosts (e.g. oob-worker.cf103-070.workers.dev) via array.join string-splitting, downloads a platform-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_\u003crand\u003e.exe,.cache_\u003crand\u003e), chmods it 0755 on POSIX, and spawns it detached via cmd.exe or /bin/sh -c. When HTTPS mirrors fail, setup.js queries DNS TXT records on numeric subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenates the chunks, base64-decodes them into a binary, writes it to disk, and executes it — a DNS-tunneled executable delivery channel designed to bypass HTTPS egress filtering. lib/telemetry.js contains a second copy of the same dropper primitives (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"], cp.spawn(\"/bin/sh\", [\"-c\", filePath+\" &\"], {detached: true})) wrapped in Sentry-lookalike SDK framing. String-splitting of hostnames and API names, mismatch between the advertised \"UI checkable\" purpose and the fetch-and-exec behavior, use of anonymous workers.dev endpoints, and the DNS-TXT covert channel together characterize a hostile install/import-time dropper.\n","modified":"2026-08-05T15:52:43.676065110Z","published":"2026-08-05T15:15:44Z","database_specific":{"malicious-packages-origins":[{"versions":["35.4.1"],"id":"IN-MAL-2026-015629","import_time":"2026-08-05T15:20:00.926583985Z","modified_time":"2026-08-05T15:15:44Z","sha256":"6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-checkable/v/35.4.1"}],"affected":[{"package":{"name":"dolyame-ui-checkable","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-checkable"},"versions":["35.4.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"d0b187961666701c8bb09be4c71b9425fa5be663338082d4f75ca8985fb3528c272dfc","path":"setup.js","sha256":"0f311708625fb064adae158ebf69b183cae7175cdf024839a44e89ded209b410"},{"sha256":"6bc33b14b66ce1758295b33db0b285bf815c59804d47a07446c2f9840f27f242","tlsh":"af835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}],"package_integrity":[{"hashes":{"sha1":"4075926f44e5623c522c64f8e131d9b563445727","sha512_sri":"sha512-gZ1jUJPRxHFj1Z1CRf96qLryb7SrDAIQTdBlmzRlN5r48LuFZz0g9yRZEWEVNxyWNxLgEMN5tk7ghzBllt+F/A=="},"filename":"dolyame-ui-checkable-35.4.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkable/MAL-2026-13143.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}