MAL-2026-13165

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-list/MAL-2026-13165.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13165
Published
2026-08-05T15:12:12Z
Modified
2026-08-05T15:52:53.782197388Z
Summary
Malicious code in dolyame-ui-list (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (db9f072ffe296e46cc8e680613ad548ddea1174c0cc481272a564c85860bfdb4)

On require() of dolyame-ui-list, index.js loads vendor.js which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-.workers.dev through cf103-.workers.dev) with a DNS TXT fallback discovery channel under *.dl.wel1.ru. Destination hostnames and API names are obfuscated via array-fragment join("") and dynamic member access (e.g. require("child" + "process"), fs["chmod" + "Sync"]). The fetched bytes are written to /var/tmp/.cache<hex> on Linux/macOS or %TEMP%\dotnetdiag<hex>.exe on Windows (a lookalike name imitating a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No version pin, no hash or signature verification, and the hosts are not the publisher's infrastructure. Environment variables DISABLETELEMETRY / ANALYTICSOPTOUT / DONOTTRACK are checked as a cover story consistent with a telemetry SDK. A second full copy of the same dropper ships as lib/telemetry.js (81 KB) with identical primitives, providing an alternate loader path. The package name resembles the Russian BNPL vendor Dolyame's UI ecosystem but the behavior matches no legitimate use.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015606",
            "import_time": "2026-08-05T15:20:00.021631854Z",
            "sha256": "db9f072ffe296e46cc8e680613ad548ddea1174c0cc481272a564c85860bfdb4",
            "modified_time": "2026-08-05T15:12:12Z",
            "versions": [
                "35.2.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-list

Package

Name
dolyame-ui-list
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-list

Affected ranges

Affected versions

35.*
35.2.6

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-sYK6et0+6R+8O1rctM6WimH2/cmBS9Or70HB7JU6YpEKKWp4uFN3lnjx6HLCe41/Yez9QEqMHslypQ3r4S7LAA==",
                "sha1": "5e0ac0df8bc08e3bd821a0ccb3e245f8ae20ff26"
            },
            "filename": "dolyame-ui-list-35.2.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "936bc6542c66f273425faed395bae778db94f5abe32591e3ccc0e2102823b258",
            "tlsh": "6ea1a69616aa70188bb097e5c6074416f65bf6633380c2d4fb5ca9981f7712483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "fea46bb313a806ce0e9e6d119c4d45ebeda3f01e1a3e259daad8f1dd486caba2",
            "tlsh": "87835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-list/MAL-2026-13165.json"