MAL-2026-13174

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-popover/MAL-2026-13174.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13174
Published
2026-08-05T15:11:03Z
Modified
2026-08-05T15:52:57.964052422Z
Summary
Malicious code in dolyame-ui-popover (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f)

On require() of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under deceptive filenames (.cache<hex>, dotnetdiag<hex>.exe,.analytics_state), chmodded 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. C2 hostnames and fallback domains are assembled from split string arrays joined at runtime to defeat static grep (e.g. ["oob-worker.cf1","00-416.workers.dev"].join("") and ['sdk','.dl.wel1','.r','u'].join("")). A cache-stamp guard prevents re-execution. A co-shipped lib/telemetry.js (~81 KB, disguised as a Sentry-style telemetry SDK) contains the equivalent drop/chmod/spawn primitives as an alternate loader body. The package name mimics a payments UI library but its only runtime effect is to fetch and execute attacker-controlled native code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:11:03Z",
            "sha256": "5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f",
            "import_time": "2026-08-05T15:19:59.730367504Z",
            "id": "IN-MAL-2026-015598",
            "source": "amazon-inspector",
            "versions": [
                "35.8.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-popover

Package

Name
dolyame-ui-popover
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-popover

Affected ranges

Affected versions

35.*
35.8.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "c7646ac080577a6077afba0185b79dbef885c8d2",
                "sha512_sri": "sha512-BExgvIq9XZhKxDAu1sh/9SE+TD9aH/eDP9LUX/joEHhcNZueFdjaItCgLTHFQ9PqOOQdmXRDqu5kvLiSIOYOSA=="
            },
            "filename": "dolyame-ui-popover-35.8.7.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_ext.js",
            "sha256": "6d0c9b2110056b4ac76cb6d6f6ddb40ea11f15daf551c515259b5b762c26aa41",
            "tlsh": "32a1a69a166670188bb0dbe4ca175816f65bf66333c0c284fb9c65981f7312483b2dfc"
        },
        {
            "sha256": "2fa2b0c5fb3444a0cb91b488c2e9d6a426936456eed39992c1159c598d6a5eb0",
            "path": "lib/telemetry.js",
            "tlsh": "79835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-popover/MAL-2026-13174.json"