{"id":"MAL-2026-13571","summary":"Malicious code in dolyame-ui-generateid (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf)\nOn require() of the package, index.js loads _shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev, with a covert DNS TXT-record fallback that reads chunk counts from c.\u003cdomain\u003e and base64 payload fragments from N.\u003cdomain\u003e under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under disguised names such as.cache_\u003crand\u003e or dotnet_diag_\u003crand\u003e.exe, chmodded 0755 on POSIX, and spawned detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd.exe /c start. A second import-reachable dropper path exists in lib/telemetry.js: it decodes base64 chunks into a Buffer, invokes fs[\"chmod\"+\"Sync\"] with mode 0o755, and calls cp.spawn(\"/bin/sh\", [\"-c\", filePath+\" &\"]). Anti-analysis techniques include split-string require(\"child_\"+\"process\"), split-property fs[\"chmod\"+\"Sync\"], array-join hostname assembly, and DNS TXT-record staged payload delivery. The package's stated purpose (a UI ID-generation helper / observability SDK) does not require fetching and executing native binaries from anonymous Cloudflare Workers domains.\n","modified":"2026-08-07T13:20:38.572571305Z","published":"2026-08-07T12:23:57Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016964","import_time":"2026-08-07T12:51:20.041775734Z","modified_time":"2026-08-07T12:23:57Z","sha256":"1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf","source":"amazon-inspector","versions":["35.8.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-generateid/v/35.8.1"}],"affected":[{"package":{"name":"dolyame-ui-generateid","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-generateid"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"f17a9dd050c9f8563680b48802201182fb2d3b4d30581adac1a086f34c489370","tlsh":"8ba1865916fa70180792e5d8841f9416b19be69332c4e8c4fb4c6a948fe7279c3b39fc"},{"path":"lib/telemetry.js","sha256":"2ab911b995b44d63d9e9e224253e743f05c1ff041b1c8fc4570b340deb8f1825","tlsh":"ab733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-Efj5Fuwwn6NX+4anH6geec4p4LJ4kcj5OwxXk9RvgUcGg8asu9IydKM+7FwNLxUouzrcZf2S52VIfUlKYhYvGA==","sha1":"43c8cde7143e1bafbab501aa85c2ea285fa2b98f"},"filename":"dolyame-ui-generateid-35.8.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-generateid/MAL-2026-13571.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}