{"id":"MAL-2026-13177","summary":"Malicious code in dolyame-ui-radio (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd)\ndolyame-ui-radio@35.2.2 is a dropper disguised as a UI/telemetry package. index.js unconditionally require()s./_adapter.js, which on module load downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under masquerading names (dotnet_diag_\u003chex\u003e.exe on Windows,.cache_\u003chex\u003e on Unix), chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Destination hostnames are assembled from split-and-joined string fragments; cache paths and opt-out env-var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK,.analytics_state) present a telemetry cover story that does not match the observed drop-and-exec behavior. A second copy of the same drop-and-exec logic (base64 chunk assembly, chmodSync 0755, spawn /bin/sh) is bundled in lib/telemetry.js, unreached in this version's import graph but shipped in the tarball. Any require() or import of this package executes attacker-controlled native code on the installer's host.\n","modified":"2026-08-05T15:52:59.887239849Z","published":"2026-08-05T15:11:19Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T15:11:19Z","sha256":"49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd","source":"amazon-inspector","versions":["35.2.2"],"id":"IN-MAL-2026-015600","import_time":"2026-08-05T15:19:59.794095414Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-radio/v/35.2.2"}],"affected":[{"package":{"name":"dolyame-ui-radio","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-radio"},"versions":["35.2.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-radio/MAL-2026-13177.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-kNlvl7VIDQuFMiolwea4CTRmie0VwKRFcM2AhkSxDIt0f+u+GmKRh0Bic6yz5AcgHTU6ck1L5FLVq0Hnx9TYqQ==","sha1":"65a1ef755eff9226f89fc45afe2e5df5d573846f"},"filename":"dolyame-ui-radio-35.2.2.tgz"}],"evidence_files":[{"path":"_adapter.js","sha256":"0691adafb8e3bf090cdd608f263f4525b22303148c91a89926894cb926896bb1","tlsh":"a7a1859a166670188bb0abf487175416f65ff6633380c2d8fb9c65941fb312482b2dfc"},{"tlsh":"f2835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"138771380255f6fc104a1c6f82875cc260e9d2c9966fc14c0a62270c6bb0e3d7"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}