{"id":"MAL-2026-13600","summary":"Malicious code in dolyame-ui-tableinline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8)\nOn require('dolyame-ui-tableinline'), index.js loads _init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors (hostnames reconstructed at runtime via string-array.join(\"\") to evade static matching), with a DNS TXT-record fallback to sdk.dl.wel1.ru. The binary is written to a disguised path under /tmp or %TEMP% (e.g., dotnet_diag_\u003crand\u003e.exe,.cache_\u003crand\u003e), chmod 0755 on POSIX, and spawned detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd /c start /b. A TTL marker file rate-limits re-execution. A second dropper (base64 buffer -\u003e chmod 755 -\u003e /bin/sh -c spawn) is duplicated inside lib/telemetry.js, the declared main module, wrapped in a fake SDK scaffold. Opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and cover-story file names (dotnet_diag_*,.analytics_state) are used as camouflage. The unpinned opaque native payloads, anonymous author-controlled hosts, obfuscated destination reconstruction, and detached background execution constitute full-host remote code execution on any machine that installs or imports the package.\n","modified":"2026-08-07T13:20:55.887605392Z","published":"2026-08-07T12:26:27Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-07T12:51:20.771578426Z","modified_time":"2026-08-07T12:26:27Z","sha256":"bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8","source":"amazon-inspector","versions":["35.8.1"],"id":"IN-MAL-2026-016981"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-ui-tableinline/v/35.8.1"}],"affected":[{"package":{"name":"dolyame-ui-tableinline","ecosystem":"npm","purl":"pkg:npm/dolyame-ui-tableinline"},"versions":["35.8.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"76a1745a15fb30180793e1d8851f9916719af6937384d584fb8ca6988fda12883f3aec","path":"_init.js","sha256":"207e3f177ee67d59c60af7328543acce487821caae99dc06089d8acae3e5c367"}],"package_integrity":[{"filename":"dolyame-ui-tableinline-35.8.1.tgz","hashes":{"sha1":"0d9e83b4fb7120141766d57a6d8df0b83ac025e5","sha512_sri":"sha512-Yi6VN2BvmHfCTc+nTl2FEcz9tj9bowSDn1DGSMTavknUA2Y3X93dJrrzvLRrOnDrVBuJy/ZFVcmYFv07ByMnHw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tableinline/MAL-2026-13600.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}