MAL-2026-13152

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-dropdown/MAL-2026-13152.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13152
Published
2026-08-05T15:14:16Z
Modified
2026-08-05T15:52:48.394320657Z
Summary
Malicious code in dolyame-ui-dropdown (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (78e2cf3af799e05f20494aba04b5d85aa1335bce541af4cb13aa715a2cda6ea5)

On require('dolyame-ui-dropdown'), index.js loads helpers.js which selects a platform-specific endpoint from an obfuscated (split-literal) host list including oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf100-416.workers.dev, with a DNS-TXT chunked fallback that assembles a base64 payload from c.<domain> and numbered n.<domain> TXT records under dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The downloaded binary is written to /var/tmp or %TEMP% under cover-story names such as.cache<hex> or dotnetdiag<hex>.exe, chmodded to 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &']).unref(). Obfuscation includes string-splitting of the childprocess require ('child' + 'process'), array-join reassembly of destination hostnames, and reflective property access such as fs['chmod'+'Sync']. A second dropper stage with the same primitives is shipped in lib/telemetry.js. A package advertised as a UI dropdown has no legitimate reason to fetch and execute platform-specific ELF/Mach-O/EXE payloads at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:14:16Z",
            "id": "IN-MAL-2026-015619",
            "import_time": "2026-08-05T15:20:00.448977981Z",
            "versions": [
                "35.6.2"
            ],
            "source": "amazon-inspector",
            "sha256": "78e2cf3af799e05f20494aba04b5d85aa1335bce541af4cb13aa715a2cda6ea5"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-dropdown

Package

Name
dolyame-ui-dropdown
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-dropdown

Affected ranges

Affected versions

35.*
35.6.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-anmqlA3fIjaqT/lUIKvXFCjLEI9m8xZflxAuezHIpF8QTGESe4U3VMoaL9nxbBjobmOXE4MBUdOHvBskNf0SWg==",
                "sha1": "3d77e198e1fbc28664e29bd6fbf37357c788656a"
            },
            "filename": "dolyame-ui-dropdown-35.6.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "tlsh": "e5a1a69a166a30184bb0d7e4c717441af65bf2633780d181fb9c65941fb613483b1efc",
            "sha256": "ce7c8621fabf5e3115d80789471e8b7be654a9243ee2d1d0548990931fa3363a"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "63835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "dfd02aa0f18f07798ea5d3e06af39bcbb0d05e2611a18b2a4b58017436898ae0"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-dropdown/MAL-2026-13152.json"