{"id":"MAL-2026-13508","summary":"Malicious code in dolyame-ui-inputpassword (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674)\nOn require of the package, index.js loads lib/telemetry.js which, together with _bootstrap.js, fetches a platform-specific binary from a rotating list of anonymous Cloudflare Workers hosts (oob-worker.cf1{00,01,02,03}-*.workers.dev) with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru (chunk count from c.\u003cdomain\u003e, base64 chunks from indexed TXT records reassembled via Buffer.from(..., 'base64')). The fetched bytes are written to a disguised temp path (.cache_\u003chex\u003e/dotnet_diag_\u003chex\u003e.exe), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Destination hostnames and module names are assembled from split string fragments (e.g. 'oob-worker.cf103-070.wo'+'rkers.d'+'ev', require('child_'+'process'), fs['chmod'+'Sync']) to evade static string search. The package presents itself as a UI input-password wrapper; the dropper behavior is unrelated to that stated purpose and is duplicated across _bootstrap.js and lib/telemetry.js so it fires whether the package is loaded via the main entry or the bootstrap side-effect.\n","modified":"2026-08-07T12:35:13.676297421Z","published":"2026-08-07T12:14:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-07T12:23:26.142900832Z","modified_time":"2026-08-07T12:14:04Z","sha256":"fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674","source":"amazon-inspector","versions":["35.8.1"],"id":"IN-MAL-2026-016894"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputpassword/v/35.8.1"}],"affected":[{"package":{"name":"dolyame-ui-inputpassword","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-inputpassword"},"versions":["35.8.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"dolyame-ui-inputpassword-35.8.1.tgz","hashes":{"sha1":"99b572623ebcd633951901205e811a812e8a2252","sha512_sri":"sha512-vz2YZu0mwceaNz/OFFAlvCnvj1L+oc18ACq26dx2VpUjbeN/BnQNj0ItHbhidN4bmj1/7IjLszLVLCBqqNxAUQ=="}}],"evidence_files":[{"sha256":"fa62697ffa77e73712abc13804a2d30363904dbcc572944005e3dab7fcfa22da","tlsh":"eca1c65916fb30180792e1d4860f5816b19af99332c5e894fb4c6a948f9b278c3f39fc","path":"_bootstrap.js"},{"sha256":"3f454ce573311e3b47419b62d9c7b56edbb77862bac57e50092f70180f131724","tlsh":"4973304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9","path":"lib/telemetry.js"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inputpassword/MAL-2026-13508.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}