MAL-2026-13160

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-input/MAL-2026-13160.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13160
Published
2026-08-05T15:13:35Z
Modified
2026-08-05T15:52:51.349422578Z
Summary
Malicious code in dolyame-ui-input (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242)

dolyame-ui-input@35.7.6 is published as a React component library but ships no UI code. On require(), index.js loads shim.js, which downloads a platform-specific binary from split-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). If HTTPS mirrors fail, the payload is reassembled from base64-encoded DNS TXT records across subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and passed through the same write+chmod+spawn path. Hostnames, module names (child_process, chmodSync), and paths are constructed by joining split fragments to defeat static analysis; comments falsely reference SHA-256 integrity checks though no verification is performed. A sibling module lib/telemetry.js contains parallel drop-and-execute logic (base64 buffer assembly, chmod 0755, spawn /bin/sh -c filePath+' &') though it is not currently on the require() path. Destinations are not publisher-controlled, the payload is unpinned and unverified, and execution is fully automatic on module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015615",
            "import_time": "2026-08-05T15:20:00.333143334Z",
            "sha256": "a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242",
            "modified_time": "2026-08-05T15:13:35Z",
            "versions": [
                "35.7.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-input

Package

Name
dolyame-ui-input
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-input

Affected ranges

Affected versions

35.*
35.7.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-EeB2wOQi7J6SCA+piRnDfTG0TzsmbkQCreoHP6YEwMfROoblb3d+W+9Ud8CZHurR+Ou4d2KtBmZPa2fGY5eXUQ==",
                "sha1": "c824ad22e662528a700c3235e31e6947a05047c2"
            },
            "filename": "dolyame-ui-input-35.7.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_shim.js",
            "sha256": "13c7671160efaa652231096f6facdf510be17ec7fbc7de398c1ccaf7b1e31181",
            "tlsh": "fea17496126a70098bb0dbe48b175416f69ff6633381c294fb5c69881f7752483b2dfc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "392b6b233aca576452208a3724db64e900f6e32d1f3cff3ddb6784f6cc8bdb8b",
            "tlsh": "0c835056566a502186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-input/MAL-2026-13160.json"