MAL-2026-13154

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-filter/MAL-2026-13154.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13154
Published
2026-08-05T15:14:41Z
Modified
2026-08-05T15:52:48.801162126Z
Summary
Malicious code in dolyame-ui-filter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (171758619b11932bfa2790206d34ea6322b3985c9cfe083915c41fdb5b18f9ed)

dolyame-ui-filter@35.5.3 is advertised as a UI toolkit but its main entry loads platform.js, which on require assembles destination hostnames at runtime via array.join('') to hide them from static inspection, resolving to Cloudflare Worker endpoints oob-worker.cf101-a.df.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf99-9b3.workers.dev, with a DNS TXT fallback that reads chunked base64 from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The module downloads a platform-specific binary via https.get, writes it to a temp path under a decoy name (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmods 0755, and spawns it detached via cmd.exe or /bin/sh -c with unref(). Comments in the file mislabel the flow as telemetry/session dedup while the actual operation fetches and executes an opaque binary from an anonymous host. The delivery signals (anonymous Cloudflare Worker infrastructure with runtime-assembled hostnames, DNS TXT covert channel, decoy filenames impersonating.NET diagnostic tooling, detached background execution, purpose mismatch with the advertised UI package) satisfy the dropper fingerprint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.5.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:14:41Z",
            "id": "IN-MAL-2026-015622",
            "sha256": "171758619b11932bfa2790206d34ea6322b3985c9cfe083915c41fdb5b18f9ed",
            "import_time": "2026-08-05T15:20:00.594874751Z"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-filter

Package

Name
dolyame-ui-filter
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-filter

Affected ranges

Affected versions

35.*
35.5.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-filter/MAL-2026-13154.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "bc551696d026c358968471375eec0d34ee2a6335",
                "sha512_sri": "sha512-eykQFWOrDFfWNQSUyk/GmSZ4K8K0EVQc+O5ssJRozoKYbEshSVO/NgDuCZ2gBh9L7OY5ZjxcP4799qqx98Gapg=="
            },
            "filename": "dolyame-ui-filter-35.5.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "91a1869616aa70198bb0dbe0c707541af65be6633780c2d8fb5ca5845f7326483b1efc",
            "path": "_platform.js",
            "sha256": "e5f1f544f8d0b68bdc3e8d8cffed1a397acf8c5ed1c2a47518d7b121cd415dd0"
        }
    ]
}