{"id":"MAL-2026-13168","summary":"Malicious code in dolyame-ui-mixins (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c202a6c0c4fddf77f53b3fc786c34627b47992e1f789701121793399dce47ebd)\nOn require of dolyame-ui-mixins, index.js loads./_ext, which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32) and downloads an opaque native binary over HTTPS from one of three Cloudflare workers.dev hosts whose names are reconstructed by array-join to evade static inspection (e.g. [\"oob-worker.cf103\",\"-070.wo\",\"rkers.d\",\"ev\"].join(\"\") yielding oob-worker.cf103-070.workers.dev, plus oob-worker.cf100-416.workers.dev and oob-worker.cf102-baf.workers.dev). A DNS TXT covert-channel fallback resolves base64 chunks from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp (or the Windows TEMP directory) under disguised filenames of the form.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe, chmod'd 0755 via fs[\"chmod\"+\"Sync\"], and spawned detached through /bin/sh -c or cmd.exe with.unref(). There is no version pin, no hash or signature verification, and no relationship between the fetched binary and the package's stated purpose of providing UI mixins. A second, parallel dropper is shipped in lib/telemetry.js under an 'Analytics SDK' cover story, using require(\"child_\"+\"process\"), base64 DNS-chunk assembly, chmod 0755, and /bin/sh -c spawn against the same infrastructure pattern.\n","modified":"2026-08-05T15:52:55.094465537Z","published":"2026-08-05T15:12:04Z","database_specific":{"malicious-packages-origins":[{"versions":["35.1.4"],"id":"IN-MAL-2026-015605","import_time":"2026-08-05T15:19:59.991069767Z","modified_time":"2026-08-05T15:12:04Z","sha256":"c202a6c0c4fddf77f53b3fc786c34627b47992e1f789701121793399dce47ebd","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-mixins/v/35.1.4"}],"affected":[{"package":{"name":"dolyame-ui-mixins","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-mixins"},"versions":["35.1.4"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"24cc6e5cdbae24816c289c76931d382d59077a31","sha512_sri":"sha512-eYneOHJZGrnqUl3TLYdK6vNb1u/NeuUD6y/vjJXmSweRjyPc1TXBq6sUxOHe1dZFSWQiOe9PznthD2zedkS/Tw=="},"filename":"dolyame-ui-mixins-35.1.4.tgz"}],"evidence_files":[{"path":"_ext.js","sha256":"0037c40c457910ac4405912ef82d4e7579b38c9c56584677c00bb00240a9f0c6","tlsh":"a3a1979a16aa70194b709be4c7174815f65ee6633781c188fb9c69885f73124c3b2efc"},{"tlsh":"fa835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"7500a178a5a6164d3340debec82d4094aa1f153e904a97a88603c5f6067c4760"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-mixins/MAL-2026-13168.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}