MAL-2026-13147

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-colors/MAL-2026-13147.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13147
Published
2026-08-05T15:16:34Z
Modified
2026-08-05T15:52:45Z
Summary
Malicious code in dolyame-ui-colors (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310)

dolyame-ui-colors@35.8.9 is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binary dropper. shim.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four Cloudflare Workers hosts whose names are assembled at runtime by splitting and rejoining string fragments (e.g. "oob-worker.cf103-070.wo"+"rk"+"ers."+"dev"): oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev. A DNS-TXT covert-channel fallback reassembles a base64 payload from numbered TXT records under c. for the hosts sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache on Unix, dotnet_diag.exe on Windows), chmod 755'd, and spawned detached via spawn("/bin/sh", ["-c", fp+" &"], {detached:true}).unref() (or a cmd equivalent on Windows). A ~6.5-hour lock file throttles re-runs to reduce visibility. The stated React-component purpose is a cover story; the destinations, drop paths, and execution shape indicate deliberate supply-chain attack code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015634",
            "import_time": "2026-08-05T15:20:01.078270151Z",
            "modified_time": "2026-08-05T15:16:34Z",
            "sha256": "d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310",
            "source": "amazon-inspector",
            "versions": [
                "35.8.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-colors

Package

Name
dolyame-ui-colors
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-colors

Affected ranges

Affected versions

35.*
35.8.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_shim.js",
            "sha256": "4005ab59880b47249cd112a70bd15cc2f393f213f101f5940ce05254df43cb43",
            "tlsh": "5cb184aa127670184bb0dbe5c7175415f55af2a37680c294f79c99981fb312483f2efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-colors-35.8.9.tgz",
            "hashes": {
                "sha1": "e5362a689ef6e2fc31eeecb4c7440ae2853baf2c",
                "sha512_sri": "sha512-AKOtAKrABZ/4pqr+Fvs7Dc2xIylqelxEhRp0BE8m5vPLcti8M98wz46mEF7Tog038AR5l0o8yVVDWpG9I0IFmg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-colors/MAL-2026-13147.json"