MAL-2026-13149

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-constants/MAL-2026-13149.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13149
Published
2026-08-05T15:15:56Z
Modified
2026-08-05T15:52:46.287932244Z
Summary
Malicious code in dolyame-ui-constants (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (55e6fcb5f8524548ac64acbf658f83a4b610700e0201d3ffe225fcd9d34f7ae2)

On require of the package, index.js loads _support.js which assembles Cloudflare Workers hostnames via split-string concatenation (["oob-work","er.cf101-adf.workers.d","ev"].join(""), plus cf102-baf and cf103-070 variants) with a DNS fallback to *.dl.wel1.ru. It downloads a platform-specific binary, writes it to /tmp or %TEMP% under deceptive names (.cache_<hex> on Linux/macOS, dotnet_diag_<hex>.exe on Windows to mimic a Microsoft diagnostic tool), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}) (and spawn("cmd",...) on Windows). The payload is unsigned, unpinned, and unverified. Environment variables named DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK frame the behavior as telemetry, but the destinations, filename disguises, and execution pattern are dropper mechanics rather than telemetry. A second, larger parallel dropper implementation lives in lib/telemetry.js (base64-decoded buffers, fs["chmod"+"Sync"], split-string require("child_"+"process"), cp.spawn('/bin/sh',['-c',filePath+' &'])), staged for activation. Installing or requiring this package causes attacker-controlled code to execute on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "55e6fcb5f8524548ac64acbf658f83a4b610700e0201d3ffe225fcd9d34f7ae2",
            "import_time": "2026-08-05T15:20:00.95694537Z",
            "id": "IN-MAL-2026-015630",
            "modified_time": "2026-08-05T15:15:56Z",
            "versions": [
                "35.5.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-constants

Package

Name
dolyame-ui-constants
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-constants

Affected ranges

Affected versions

35.*
35.5.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-constants/MAL-2026-13149.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-lzpGhI09sHSusYSK0qZfqenem6NHjJBUEH2hsTPUwSKQMbWhnD6IwAGfAotAc+ReqPN23ReG8k1xcGVhNLZbZw==",
                "sha1": "67bc21a58ce72a9fd524c1f20141e94157ffde26"
            },
            "filename": "dolyame-ui-constants-35.5.9.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d9b1b69606a670198bb0dbe48717541af65ff5733780c194fb9ca5881f7612483b2efc",
            "sha256": "7d96819162605fa3e6e4bee5e49501bf866327b61454b7155ad65be2e073e768",
            "path": "_support.js"
        },
        {
            "tlsh": "76835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "058c1ac12346951faac5420bf3a22e5488826fc97ccca32515ca8f7d32786d38",
            "path": "lib/telemetry.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]