{"id":"MAL-2026-13593","summary":"Malicious code in dolyame-ui-popupcarousel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6)\nOn require of the package, _support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback via *.dl.wel1.ru, write the payload to /tmp or %TEMP% under decoy filenames (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. Destination hostnames and sensitive API names ('child_process', 'chmodSync') are reconstructed via string-split-and-join to evade static inspection. The main entry unconditionally require()s _support.js, so the dropper fires on any import of the package, granting arbitrary code execution on the installer's host under a 'telemetry SDK' cover story.\n","modified":"2026-08-07T13:20:51.798565676Z","published":"2026-08-07T12:26:08Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-07T12:51:20.710805572Z","modified_time":"2026-08-07T12:26:08Z","sha256":"2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6","source":"amazon-inspector","versions":["35.8.1"],"id":"IN-MAL-2026-016979"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-popupcarousel/v/35.8.1"}],"affected":[{"package":{"name":"dolyame-ui-popupcarousel","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-popupcarousel"},"versions":["35.8.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-popupcarousel/MAL-2026-13593.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"0fa40dff37137d6106f9b12943745ae82ab2ea1f3a4a451bf43987ee2d07b51c","tlsh":"1fa1d95a16fa70080693e4d5842f5816b19bf95332c4f9d0fb4ca6988f9a138c3b39fc","path":"_support.js"},{"sha256":"7740348095bc39382f7e524be166a377eac7fb48f8f2397dc36f0a40a4ac68f6","tlsh":"f373304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9","path":"lib/telemetry.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-vyFHJj+0ddXFKAGSubcwc5+Yr8NMpTHdwEheTdFToCLXJCSvrR3luMAoV9PJfP23z0YT/DhzUhFol9YnN9FXzw==","sha1":"ef08101fceea78646098f3d80158d05abc4712f6"},"filename":"dolyame-ui-popupcarousel-35.8.1.tgz"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}