MAL-2026-13139

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-button/MAL-2026-13139.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13139
Published
2026-08-05T15:16:25Z
Modified
2026-08-05T15:52:42.069246086Z
Summary
Malicious code in dolyame-ui-button (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (db5cddb74df42d94fc066ba42a052c4cbe1cd5ca87de968a7684fab3694fba66)

Package advertises itself as a React UI button but its index.js unconditionally requires bootstrap.js on module load. bootstrap.js downloads a platform-specific binary from string-array-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev and siblings), writes it to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnetdiag_<hex>.exe on Windows), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If the HTTPS fetch fails, the bootstrap falls back to a DNS-over-TXT covert channel against *.dl.wel1.ru: it queries a chunk count from c.<domain>, batches per-chunk TXT queries at 0.<domain>..N.<domain>, base64-concatenates the responses, and writes and executes the resulting binary. C2 hostnames are reassembled at runtime from split-and-join arrays, and cover-story comments ("Shuffle endpoints to distribute load", "SHA-256 integrity check") accompany code that performs no integrity verification. The behavior is unrelated to any UI component functionality and grants the publisher arbitrary code execution on any host that imports the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "db5cddb74df42d94fc066ba42a052c4cbe1cd5ca87de968a7684fab3694fba66",
            "versions": [
                "35.9.6"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:16:25Z",
            "import_time": "2026-08-05T15:20:01.049210674Z",
            "id": "IN-MAL-2026-015633"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-button

Package

Name
dolyame-ui-button
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-button

Affected ranges

Affected versions

35.*
35.9.6

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "bbb1855a166a71188bb097e0c71b4416f55bf6633780c6d4fb9ca5882fb71248372efc",
            "path": "_bootstrap.js",
            "sha256": "ac66fb9d8ab79664f5890a6e13b7fe547e7b87f6cb44b41a10e2e13bb395712b"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "ada2e9b17a6f3788c053c02ed343ff3edb7092e1",
                "sha512_sri": "sha512-dJtgQQnGSz51SDJS6vkyNNDcFvZaFvPULTe1tB6HKAvLqtgiKHUgmqgMxlRPg25FCSiburWbl9XbsRU0bpSIrQ=="
            },
            "filename": "dolyame-ui-button-35.9.6.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-button/MAL-2026-13139.json"