{"id":"MAL-2026-13153","summary":"Malicious code in dolyame-ui-editor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1f6642eec29e9035341e49ff09ed56a229254b409a463b8aa7a2932d40a833d)\ndolyame-ui-editor 35.6.6 is not a UI editor. index.js unconditionally requires./_loader on module load. _loader.js selects a platform-specific asset, obfuscates its destination hostnames via array.join() (e.g. 'oob-worker.cf99-9b3.workers.dev' and 'sdk.dl.wel1.ru'), fetches an opaque binary over HTTPS from a rotated list of Cloudflare Workers hosts with a DNS TXT-record fallback channel, writes it under /tmp/.cache_\u003chex\u003e or %TEMP%\\dotnet_diag_\u003chex\u003e.exe with disguised names, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. child_process is loaded via require(\"child_\"+\"process\") and chmodSync is accessed via fs[\"chmod\"+\"Sync\"] to evade static scanners. lib/telemetry.js ships an 81KB mirror of the same drop-and-execute primitives (endpoint rotation, DNS-based service discovery, base64-decoded buffer, chmodSync 0755, detached /bin/sh spawn), staged for later activation. No hash or signature verification of the fetched payload; destinations are unrelated to any stated 'visual components' purpose and the fetched bytes are opaque. The package is a lure whose install/require executes attacker-controlled code on the installer's host.\n","modified":"2026-08-05T15:52:48.507811770Z","published":"2026-08-05T15:15:05Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T15:15:05Z","sha256":"d1f6642eec29e9035341e49ff09ed56a229254b409a463b8aa7a2932d40a833d","source":"amazon-inspector","versions":["35.6.6"],"id":"IN-MAL-2026-015625","import_time":"2026-08-05T15:20:00.726511304Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-editor/v/35.6.6"}],"affected":[{"package":{"name":"dolyame-ui-editor","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-editor"},"versions":["35.6.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"1aa1965a22aa71188bb0e7f087175419f65af6633380c2d4fb9c65980fb312483b1efc","path":"_loader.js","sha256":"0781f9a809c50381c909c29c9a550a88129a065df15357de9b7ad6b530f2e37f"},{"path":"lib/telemetry.js","sha256":"2ca039425fc05d3ad1677b3e8cfa6373dbd00ce3089661d00eb59c87b802e3d9","tlsh":"b8835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-O6NecTlaxWINS7KxzURopQiuSzVaDje0Z1DGL7zmKXklwq4SADJMxs4xKqNs9xWCu6GvWP1ycunclcF4tWgSGw==","sha1":"6d9651b1ebedbba4c1835c0fc56f3088819223c9"},"filename":"dolyame-ui-editor-35.6.6.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-editor/MAL-2026-13153.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}