MAL-2026-13144

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkbox/MAL-2026-13144.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13144
Published
2026-08-05T15:16:05Z
Modified
2026-08-05T15:52:43.999767855Z
Summary
Malicious code in dolyame-ui-checkbox (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2a445ffd0f222f7d58ad870ad641f9dd2fb21a1cc43795cbef5c58109cafebbe)

On require of the package, index.js loads vendor.js, which reconstructs a set of C2 hostnames from string-split fragments (four *.workers.dev mirrors and a *.dl.wel1.ru DNS-TXT fallback), selects a per-platform endpoint, downloads an attacker-controlled binary via https.get (or reassembles it from chunked base64 DNS TXT records at c.<domain>/<i>.<domain> when HTTPS is blocked), writes it to /var/tmp on Unix or %TEMP% on Windows under cover-story names such as.cache<hex> or dotnetdiag<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A second, functionally equivalent dropper is packaged as lib/telemetry.js (81 KB), disguised as an analytics SDK, implementing the same fetch->chmod 755->spawn('/bin/sh','-c', path+' &') pattern with a base64-decoded payload path. Host reconstruction via string-splitting and the DNS-TXT covert transport are anti-analysis features paired with the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:16:05Z",
            "source": "amazon-inspector",
            "sha256": "2a445ffd0f222f7d58ad870ad641f9dd2fb21a1cc43795cbef5c58109cafebbe",
            "import_time": "2026-08-05T15:20:00.987517906Z",
            "id": "IN-MAL-2026-015631",
            "versions": [
                "35.6.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-checkbox

Package

Name
dolyame-ui-checkbox
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-checkbox

Affected ranges

Affected versions

35.*
35.6.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-checkbox-35.6.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-BXxRHyDyjbEhaJjk+uYDg5+XzmM1YR9R+ix0US5gjypHvbhc7BoRsBkd92FPg3mwflUNIJgXb/CEDzMexuMUzA==",
                "sha1": "d4917cea98efc56fa8dc7a60385ee3da3fbe452d"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0ea1859a12a970184bb097e0c61b4415f95bf6633780d295fb5ca9985fb602483b2efc",
            "sha256": "dec2d9ed93f1d1221ca47a48f208bed542fe1d0bc1f2f545ebb7ad8f238bbd70",
            "path": "_vendor.js"
        },
        {
            "tlsh": "14835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "e69c6a5ef987e7b69c3f46d197fd568e24039d3d30c400669a9815250db17f77",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkbox/MAL-2026-13144.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]