{"id":"MAL-2026-13598","summary":"Malicious code in dolyame-ui-selectaccount (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363)\nOn require() of the package, index.js loads _bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute dropper. The code selects a platform-tagged asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and fetches it from string-split, obfuscated hostnames of the form oob-worker.cf1XX-XXX.workers.dev, with a DNS-TXT chunked-base64 fallback over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under disguised names (.cache_\u003crand\u003e or dotnet_diag_\u003crand\u003e.exe), chmodded to 0755 via fs[\"chmod\"+\"Sync\"], and spawned detached with stdio ignored via cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"], { detached: true, stdio: \"ignore\" }).unref() or cmd.exe /c start /b. Dangerous API names are assembled at runtime by string concatenation (require(\"child_\" + \"process\")) and the destination hostnames are reconstructed with Array.join to hide the C2 from static inspection. The 'Analytics SDK' / 'telemetry' framing does not correspond to the code's actual behavior, which is unconditional retrieval and execution of an attacker-controlled native binary on the installer's host at import time. No integrity check, pinning, or signature verification is performed on the downloaded payload.\n","modified":"2026-08-07T13:20:54.612632006Z","published":"2026-08-07T12:24:12Z","database_specific":{"malicious-packages-origins":[{"versions":["35.8.1"],"id":"IN-MAL-2026-016966","import_time":"2026-08-07T12:51:20.106027716Z","modified_time":"2026-08-07T12:24:12Z","sha256":"4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-selectaccount/v/35.8.1"}],"affected":[{"package":{"name":"dolyame-ui-selectaccount","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-selectaccount"},"versions":["35.8.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"dolyame-ui-selectaccount-35.8.1.tgz","hashes":{"sha512_sri":"sha512-I7njemB0eaTnqtd/baavV7sZnuAKge+6jfKnhnHYZOQr9nk2ne4WXFKUUjh6SaDOMC+FxLhZ+qpbHPfPBJLGCA==","sha1":"c496a49d1d4e17a81ec362597c73a4008056178d"}}],"evidence_files":[{"sha256":"9f357211560f752d5cd5b66c23973f779898903e21acf4b9dbcbd67b32364c1c","tlsh":"b3a1b61a12fb70284792e6d4851f5416729eea9332c4d8c4fb4c66548fa627983f39ec","path":"_bootstrap.js"},{"sha256":"0bbc11d9fda2abf4cb0bef9746d7373532664280813b333e18305650bdbc9ccb","tlsh":"f373304966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9","path":"lib/telemetry.js"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-selectaccount/MAL-2026-13598.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}