MAL-2026-13143

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkable/MAL-2026-13143.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13143
Published
2026-08-05T15:15:44Z
Modified
2026-08-05T15:52:43.676065110Z
Summary
Malicious code in dolyame-ui-checkable (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c)

index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of Cloudflare workers.dev mirror hosts (e.g. oob-worker.cf103-070.workers.dev) via array.join string-splitting, downloads a platform-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnetdiag<rand>.exe,.cache<rand>), chmods it 0755 on POSIX, and spawns it detached via cmd.exe or /bin/sh -c. When HTTPS mirrors fail, setup.js queries DNS TXT records on numeric subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenates the chunks, base64-decodes them into a binary, writes it to disk, and executes it — a DNS-tunneled executable delivery channel designed to bypass HTTPS egress filtering. lib/telemetry.js contains a second copy of the same dropper primitives (require("child"+"process"), fs["chmod"+"Sync"], cp.spawn("/bin/sh", ["-c", filePath+" &"], {detached: true})) wrapped in Sentry-lookalike SDK framing. String-splitting of hostnames and API names, mismatch between the advertised "UI checkable" purpose and the fetch-and-exec behavior, use of anonymous workers.dev endpoints, and the DNS-TXT covert channel together characterize a hostile install/import-time dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:15:44Z",
            "source": "amazon-inspector",
            "sha256": "6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c",
            "import_time": "2026-08-05T15:20:00.926583985Z",
            "id": "IN-MAL-2026-015629",
            "versions": [
                "35.4.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-checkable

Package

Name
dolyame-ui-checkable
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-checkable

Affected ranges

Affected versions

35.*
35.4.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-checkable-35.4.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-gZ1jUJPRxHFj1Z1CRf96qLryb7SrDAIQTdBlmzRlN5r48LuFZz0g9yRZEWEVNxyWNxLgEMN5tk7ghzBllt+F/A==",
                "sha1": "4075926f44e5623c522c64f8e131d9b563445727"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d0b187961666701c8bb09be4c71b9425fa5be663338082d4f75ca8985fb3528c272dfc",
            "sha256": "0f311708625fb064adae158ebf69b183cae7175cdf024839a44e89ded209b410",
            "path": "setup.js"
        },
        {
            "tlsh": "af835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "sha256": "6bc33b14b66ce1758295b33db0b285bf815c59804d47a07446c2f9840f27f242",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkable/MAL-2026-13143.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]