{"id":"MAL-2026-13181","summary":"Malicious code in dolyame-ui-scroll (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247)\nOn require() of the package main, _init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of author-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). Destination hostnames are reconstructed at runtime via array-join string splitting to defeat static inspection. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on POSIX, dotnet_diag_\u003chex\u003e.exe on Windows), chmod 755'd on POSIX, and executed detached via spawn('/bin/sh','-c',...) or spawn('cmd', ['/c','start',...]). If HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel against *.dl.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reassembles a base64-chunked payload from TXT records, and executes the reconstructed binary. No signature or hash verification is performed, and the fetch-and-execute behavior is unrelated to the package's stated UI-components purpose.\n","modified":"2026-08-05T15:53:01.457183887Z","published":"2026-08-05T15:10:54Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:59.702370905Z","modified_time":"2026-08-05T15:10:54Z","sha256":"a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247","source":"amazon-inspector","versions":["35.4.3"],"id":"IN-MAL-2026-015597"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-scroll/v/35.4.3"}],"affected":[{"package":{"name":"dolyame-ui-scroll","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-scroll"},"versions":["35.4.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-scroll/MAL-2026-13181.json","indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-Jxn31dRkcaFASjF8vQ9GXdtE1yKkwuXziwLxi8NV8nzCXlJRqyRMD0xM5jPpaNx3qMmYAbo86BJxdl1xb08uoA==","sha1":"00b3455b353ba556bb61944aa812686866472828"},"filename":"dolyame-ui-scroll-35.4.3.tgz"}],"evidence_files":[{"sha256":"ad830194c1b1edddcadd777e3e44eea0538436d2f643ebcb264a16c410a5015b","tlsh":"a9b1a66a127670098bb0dbe48b1b5415f6aaf6a333809184fb5c65944f7716883b2efc","path":"_init.js"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}