MAL-2026-13153

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-editor/MAL-2026-13153.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13153
Published
2026-08-05T15:15:05Z
Modified
2026-08-05T15:52:48Z
Summary
Malicious code in dolyame-ui-editor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d1f6642eec29e9035341e49ff09ed56a229254b409a463b8aa7a2932d40a833d)

dolyame-ui-editor 35.6.6 is not a UI editor. index.js unconditionally requires./loader on module load. loader.js selects a platform-specific asset, obfuscates its destination hostnames via array.join() (e.g. 'oob-worker.cf99-9b3.workers.dev' and 'sdk.dl.wel1.ru'), fetches an opaque binary over HTTPS from a rotated list of Cloudflare Workers hosts with a DNS TXT-record fallback channel, writes it under /tmp/.cache or %TEMP%\dotnet_diag.exe with disguised names, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. child_process is loaded via require("child_"+"process") and chmodSync is accessed via fs["chmod"+"Sync"] to evade static scanners. lib/telemetry.js ships an 81KB mirror of the same drop-and-execute primitives (endpoint rotation, DNS-based service discovery, base64-decoded buffer, chmodSync 0755, detached /bin/sh spawn), staged for later activation. No hash or signature verification of the fetched payload; destinations are unrelated to any stated 'visual components' purpose and the fetched bytes are opaque. The package is a lure whose install/require executes attacker-controlled code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015625",
            "import_time": "2026-08-05T15:20:00.726511304Z",
            "modified_time": "2026-08-05T15:15:05Z",
            "sha256": "d1f6642eec29e9035341e49ff09ed56a229254b409a463b8aa7a2932d40a833d",
            "source": "amazon-inspector",
            "versions": [
                "35.6.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-editor

Package

Name
dolyame-ui-editor
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-editor

Affected ranges

Affected versions

35.*
35.6.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_loader.js",
            "sha256": "0781f9a809c50381c909c29c9a550a88129a065df15357de9b7ad6b530f2e37f",
            "tlsh": "1aa1965a22aa71188bb0e7f087175419f65af6633380c2d4fb9c65980fb312483b1efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "2ca039425fc05d3ad1677b3e8cfa6373dbd00ce3089661d00eb59c87b802e3d9",
            "tlsh": "b8835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-editor-35.6.6.tgz",
            "hashes": {
                "sha1": "6d9651b1ebedbba4c1835c0fc56f3088819223c9",
                "sha512_sri": "sha512-O6NecTlaxWINS7KxzURopQiuSzVaDje0Z1DGL7zmKXklwq4SADJMxs4xKqNs9xWCu6GvWP1ycunclcF4tWgSGw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-editor/MAL-2026-13153.json"