MAL-2026-13188

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-swiper/MAL-2026-13188.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13188
Published
2026-08-05T15:09:07Z
Modified
2026-08-05T15:53:04.342551173Z
Summary
Malicious code in dolyame-ui-swiper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a)

On require() of the package's main entry, bridge.js unconditionally runs an init() routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, writes it under /tmp or %TEMP% with a disguised name (.cache<hex> or dotnetdiag<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Destination hostnames and the child_process identifier are assembled at runtime by joining string fragments to evade static inspection. The package is advertised as a UI component library; the fetched binary has no relationship to that stated purpose, is hosted on anonymous edge-worker infrastructure, is unpinned and unverified, and is executed with the privileges of the installing process. Requiring or installing the package results in arbitrary remote code execution on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:09:07Z",
            "source": "amazon-inspector",
            "sha256": "5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a",
            "import_time": "2026-08-05T15:19:59.26543265Z",
            "id": "IN-MAL-2026-015586",
            "versions": [
                "35.7.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-swiper

Package

Name
dolyame-ui-swiper
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-swiper

Affected ranges

Affected versions

35.*
35.7.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-swiper-35.7.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-FqvjNOe9FAP91qOOOE8XUKZ/JE1XbfxyKj7GRuJbJ8dq5B2MmmOGis1yIfUmT1+u/CLdiyb8/Ir86cLULi5gGw==",
                "sha1": "b0b4757afbe7f74ab23e391c11517389c79836ff"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "daa1a5aa056670184bb0d7e4c617581af25bf6633780d298fb9c958c1fb212483b2efc",
            "sha256": "62df202abddebd164d80003c75ee5a987f1021c4fa3e9ad0b1161fef6f2d3169",
            "path": "_bridge.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-swiper/MAL-2026-13188.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]