{"id":"MAL-2026-13192","summary":"Malicious code in dolyame-ui-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d)\nindex.js unconditionally requires./_platform on module load. _platform.js reconstructs attacker-controlled hostnames via string-splitting (Array.join) to fetch a platform-specific native binary from one of four Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev). On HTTPS failure it falls back to a DNS-TXT covert channel under wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reading a chunk count from c.\u003cdomain\u003e and reassembling base64-encoded payload chunks from N.\u003cdomain\u003e TXT records. The fetched binary is written to /tmp or the Windows temp directory under decoy names (dotnet_diag_*.exe,.cache_*,.analytics_state), chmod 0755, and spawned detached/unref'd via /bin/sh -c or cmd.exe /c start /b. A second, currently-unreferenced dropper in lib/telemetry.js duplicates the same fetch-\u003echmod-\u003espawn pattern behind a 'telemetry SDK' cover story, using require(\"child_\"+\"process\") and fs[\"chmod\"+\"Sync\"] to further obfuscate dangerous APIs. A UI package has no legitimate reason for this behavior; the destination obfuscation, DNS-TXT fallback, decoy filenames, and parallel staged dropper module together fingerprint a supply-chain attack delivering full-host remote code execution to any installer that requires the package.\n","modified":"2026-08-05T15:53:06.485425347Z","published":"2026-08-05T15:08:52Z","database_specific":{"malicious-packages-origins":[{"sha256":"8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d","source":"amazon-inspector","versions":["35.2.5"],"id":"IN-MAL-2026-015584","import_time":"2026-08-05T15:19:59.184636747Z","modified_time":"2026-08-05T15:08:52Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-test/v/35.2.5"}],"affected":[{"package":{"name":"dolyame-ui-test","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-test"},"versions":["35.2.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"dolyame-ui-test-35.2.5.tgz","hashes":{"sha1":"ad244c053c53f051a5c83011d5892eaa31423f1b","sha512_sri":"sha512-g3IPjHDSawwJ5/RAKWbomSP5qzuxKsvRYVEkJSOocA9LOoZSChT+jCzW078pZEydB2cW1IQuJnr8KMvR9zol4g=="}}],"evidence_files":[{"path":"_platform.js","sha256":"0f09d20c6d2461ae9c95dd671101be4c435e2ef69432de14bc0889b604e1af26","tlsh":"4fa1a75a05a670098bb0e7e4c7175816f65bf66337c0c294f79c69885f7312482b2efc"},{"sha256":"bffb30c669600dbcb3eb43e3ec6f81b76ddbda3866d2643674852c7e8a67c631","tlsh":"72835055566a602186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-test/MAL-2026-13192.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}