MAL-2026-13135

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-avatar/MAL-2026-13135.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13135
Published
2026-08-05T15:18:24Z
Modified
2026-08-05T15:52:40.080438980Z
Summary
Malicious code in dolyame-ui-avatar (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e)

On package load, index.js requires./platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with DNS-TXT fallback resolvers under *.dl.wel1.ru (sdk/ext/pkg/net). Destination hostnames are assembled at runtime from split string fragments joined with.join('') to evade static analysis. The fetched payload is written to /tmp or %TEMP% under disguised names (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A marker file.analytics_state is written to throttle re-execution. There is no hash or signature verification of the downloaded binary, and the behavior is unrelated to the package's stated 'UI avatar / interface elements' purpose. The package name mimics the legitimate dolyame payment SDK ecosystem.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015646",
            "import_time": "2026-08-05T15:20:01.4505189Z",
            "sha256": "3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e",
            "modified_time": "2026-08-05T15:18:24Z",
            "versions": [
                "35.9.8"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-avatar

Package

Name
dolyame-ui-avatar
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-avatar

Affected ranges

Affected versions

35.*
35.9.8

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-r2XxSB8DmUZIpfBGRl2sLmBTnTnX5U+RIeoWujIxInISGOpc4ij0mvx0Yld/viO3L3zWEgEtJ+hHH0FGSOZETA==",
                "sha1": "b96679c95349f4d0104e0fa3fa98ab643ff3edcc"
            },
            "filename": "dolyame-ui-avatar-35.9.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_platform.js",
            "sha256": "ca0cc95a512f6bf5a71fdf9f3e6508a50d344f600595eefa8707032a41414dbf",
            "tlsh": "05b18696126a70094fb0d7e4c72b9816f55af6633b81c288f75c55985f7302483b2dfc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-avatar/MAL-2026-13135.json"