MAL-2026-13157

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-grid/MAL-2026-13157.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13157
Published
2026-08-05T15:14:26Z
Modified
2026-08-05T15:52:50.204630613Z
Summary
Malicious code in dolyame-ui-grid (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f21d1f60c7f97ffdc8e698c9804d9d9116f286be7a026a9c90f6e4a1858dea18)

On require('dolyame-ui-grid'), index.js loads polyfill.js which selects a platform-specific asset, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT chunked fallbacks under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or the Windows Temp directory under a disguised name (.cache<rand> or dotnetdiag<rand>.exe), chmods it 0755, and spawns it detached via spawn('/bin/sh') or spawn('cmd'). Destination hostnames are assembled at runtime by.join('') on split string fragments, and a.analytics_state mtime file gates re-execution cadence, with comments framing the code as 'telemetry'/'analytics'. A parallel dropper implementation in lib/telemetry.js (base64-decoded chunks, chmodSync 0755, cp.spawn('/bin/sh',['-c', filePath+' &'])) is present but not reachable from the main require graph. The download hosts are unrelated to the package publisher, the fetched bytes are opaque and unverified, and execution happens unconditionally on module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:14:26Z",
            "id": "IN-MAL-2026-015620",
            "import_time": "2026-08-05T15:20:00.479096828Z",
            "versions": [
                "35.7.4"
            ],
            "source": "amazon-inspector",
            "sha256": "f21d1f60c7f97ffdc8e698c9804d9d9116f286be7a026a9c90f6e4a1858dea18"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-grid

Package

Name
dolyame-ui-grid
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-grid

Affected ranges

Affected versions

35.*
35.7.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-grid-35.7.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-PsMZbG4IZ8vrEHcQwmLy/yox9NFQkgsAPmQ5ryqoV6xBzCFhroArS3FCC4IN2dIxmz2U7yAO4N0G+7ulKnPQOw==",
                "sha1": "c7c61b9ab38c5d599ae02390841aefc93e20531f"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "tlsh": "11b1c856166a70194bb0dbe1c7174419f65bf66333818694f75ca9881fb3224c3b1efc",
            "sha256": "ab3cdb74602f8edcdd6f10a52b74d8e1208ade53925b843dd440b6bce093cf7e"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "51835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "dfdac85ec50a35680defe82480ac91c6d42ae1ffb0c5901a98af96a9ed72d5c9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-grid/MAL-2026-13157.json"