{"id":"MAL-2026-13147","summary":"Malicious code in dolyame-ui-colors (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310)\ndolyame-ui-colors@35.8.9 is advertised as a React UI color library but its main entry requires./_shim.js on load, which acts as a platform-aware binary dropper. _shim.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four Cloudflare Workers hosts whose names are assembled at runtime by splitting and rejoining string fragments (e.g. \"oob-worker.cf103-070.wo\"+\"rk\"+\"ers.\"+\"dev\"): oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev. A DNS-TXT covert-channel fallback reassembles a base64 payload from numbered TXT records under c.\u003cdomain\u003e for the hosts sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmod 755'd, and spawned detached via spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}).unref() (or a cmd equivalent on Windows). A ~6.5-hour lock file throttles re-runs to reduce visibility. The stated React-component purpose is a cover story; the destinations, drop paths, and execution shape indicate deliberate supply-chain attack code.\n","modified":"2026-08-05T15:52:45.755031282Z","published":"2026-08-05T15:16:34Z","database_specific":{"malicious-packages-origins":[{"versions":["35.8.9"],"id":"IN-MAL-2026-015634","import_time":"2026-08-05T15:20:01.078270151Z","modified_time":"2026-08-05T15:16:34Z","sha256":"d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-colors/v/35.8.9"}],"affected":[{"package":{"name":"dolyame-ui-colors","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-colors"},"versions":["35.8.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-colors/MAL-2026-13147.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"dolyame-ui-colors-35.8.9.tgz","hashes":{"sha512_sri":"sha512-AKOtAKrABZ/4pqr+Fvs7Dc2xIylqelxEhRp0BE8m5vPLcti8M98wz46mEF7Tog038AR5l0o8yVVDWpG9I0IFmg==","sha1":"e5362a689ef6e2fc31eeecb4c7440ae2853baf2c"}}],"evidence_files":[{"path":"_shim.js","sha256":"4005ab59880b47249cd112a70bd15cc2f393f213f101f5940ce05254df43cb43","tlsh":"5cb184aa127670184bb0dbe5c7175415f55af2a37680c294f79c99981fb312483f2efc"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}