{"id":"MAL-2026-13574","summary":"Malicious code in dolyame-ui-inputautocomplete (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb)\nOn require/import, _bootstrap.js selects a platform-specific path (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64) and downloads an opaque native binary over HTTPS from author-controlled hosts whose names are reconstructed at runtime from string-split arrays: oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf101-adf.workers.dev. A fallback path reassembles a base64 payload from enumerated DNS TXT records under sdk.dl.wel1.ru (c./0./1./... subdomain enumeration). The fetched bytes are written to /tmp/.cache_\u003crnd\u003e on Unix or %TEMP%/dotnet_diag_\u003crnd\u003e.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd. Any process that require()s the package immediately executes attacker-controlled native code with the installer's privileges; the string-splitting, filename masquerading as diagnostic caches, and DNS-TXT reassembly channel are active anti-analysis techniques rather than legitimate SDK behavior.\n","modified":"2026-08-07T13:20:40.237733567Z","published":"2026-08-07T12:36:23Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-07T12:36:23Z","sha256":"7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb","source":"amazon-inspector","versions":["35.8.1"],"id":"IN-MAL-2026-017048","import_time":"2026-08-07T12:51:23.819329562Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-inputautocomplete/v/35.8.1"}],"affected":[{"package":{"name":"dolyame-ui-inputautocomplete","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-inputautocomplete"},"versions":["35.8.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"dolyame-ui-inputautocomplete-35.8.1.tgz","hashes":{"sha512_sri":"sha512-i1NsbM4cDIuE4aJs2Ts8wE809lopKM/nUTa77PmS//rl4RZndM5Q5xDkm5nGVtG6D7056z80qR4BxzXj9GPeBA==","sha1":"a82764c732bfafe6ee83614a3931cb3153cc1f24"}}],"evidence_files":[{"sha256":"9d8ddf934f4bda0ede046ecf811bf60455cf501377c74765e595f8cd8107fa73","tlsh":"92a1a75a1afa70180692d5d8842f5412b1efe55336c4e8d4fb8ca6984f9713883f39fc","path":"_bootstrap.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inputautocomplete/MAL-2026-13574.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}