MAL-2026-13172

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-pagination/MAL-2026-13172.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13172
Published
2026-08-05T15:10:41Z
Modified
2026-08-05T15:52:57.513963524Z
Summary
Malicious code in dolyame-ui-pagination (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7)

On require of the package, index.js loads./polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at runtime via array-join string splitting to evade static matching, resolving to Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev). A platform-specific binary is downloaded, written to /tmp or %TEMP% under disguised names such as.cache<hex> or dotnetdiag<hex>.exe, chmod'd to 0755, and spawned detached via /bin/sh -c or cmd. A secondary covert channel resolves TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-decoding the concatenated TXT fragments into an executable buffer when the HTTPS mirrors fail. A sibling module lib/telemetry.js ships the same dropper primitives (base64-decoded buffer, split-property fs['chmod'+'Sync'], /bin/sh spawn) though it is not on the entrypoint graph from index.js. Destinations are unrelated to the package's stated purpose (a UI pagination component), unpinned, and unverified; the fetched bytes are opaque and executed.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:10:41Z",
            "id": "IN-MAL-2026-015596",
            "import_time": "2026-08-05T15:19:59.674747115Z",
            "versions": [
                "35.2.5"
            ],
            "source": "amazon-inspector",
            "sha256": "7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-pagination

Package

Name
dolyame-ui-pagination
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-pagination

Affected ranges

Affected versions

35.*
35.2.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-pagination/MAL-2026-13172.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-i1oPitqbhTDWJ3VAh/B9kK34UcXF59xK7ZQmykKK1rfKc/KGq1YvJ1UYRWIjcJlPtOljGeHMvC3rp4abPPswIA==",
                "sha1": "54011f314548333d3f7f2cb2c1710f0ba124efa7"
            },
            "filename": "dolyame-ui-pagination-35.2.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "tlsh": "99b196a615a630188bb0d7e4c7176406f55bf6637780d2d8fb9ca5980fb621482b3efc",
            "sha256": "92eb3fc8d556fd2974a879e57abe6d35c02519baf47eb8086fa7b4ad2c94c696"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "07835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "c15769a4fd359fa44d08ea137f1c6612563f2030598e050a478b0436e9a6dcd7"
        }
    ]
}