MAL-2026-13177

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-radio/MAL-2026-13177.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13177
Published
2026-08-05T15:11:19Z
Modified
2026-08-05T15:52:59.887239849Z
Summary
Malicious code in dolyame-ui-radio (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd)

dolyame-ui-radio@35.2.2 is a dropper disguised as a UI/telemetry package. index.js unconditionally require()s./adapter.js, which on module load downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under masquerading names (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Destination hostnames are assembled from split-and-joined string fragments; cache paths and opt-out env-var names (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK,.analyticsstate) present a telemetry cover story that does not match the observed drop-and-exec behavior. A second copy of the same drop-and-exec logic (base64 chunk assembly, chmodSync 0755, spawn /bin/sh) is bundled in lib/telemetry.js, unreached in this version's import graph but shipped in the tarball. Any require() or import of this package executes attacker-controlled native code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:11:19Z",
            "id": "IN-MAL-2026-015600",
            "import_time": "2026-08-05T15:19:59.794095414Z",
            "sha256": "49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd",
            "versions": [
                "35.2.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-radio

Package

Name
dolyame-ui-radio
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-radio

Affected ranges

Affected versions

35.*
35.2.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-radio-35.2.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-kNlvl7VIDQuFMiolwea4CTRmie0VwKRFcM2AhkSxDIt0f+u+GmKRh0Bic6yz5AcgHTU6ck1L5FLVq0Hnx9TYqQ==",
                "sha1": "65a1ef755eff9226f89fc45afe2e5df5d573846f"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "a7a1859a166670188bb0abf487175416f65ff6633380c2d8fb9c65941fb312482b2dfc",
            "sha256": "0691adafb8e3bf090cdd608f263f4525b22303148c91a89926894cb926896bb1",
            "path": "_adapter.js"
        },
        {
            "tlsh": "f2835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "138771380255f6fc104a1c6f82875cc260e9d2c9966fc14c0a62270c6bb0e3d7",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-radio/MAL-2026-13177.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]