MAL-2026-13190

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tabs/MAL-2026-13190.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13190
Published
2026-08-05T15:08:59Z
Modified
2026-08-05T15:53:05.481654659Z
Summary
Malicious code in dolyame-ui-tabs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4beccb0ba046e54873e7d6af1d2023eb5f01a0eab4ed5abe336de2e3e3a74993)

index.js requires./support, whose top-level run() fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (reconstructed via array.join() such as ['oob-worker.cf102-baf.','worker','s.','dev']) with a DNS-TXT chunked base64 fallback channel served from *.dl.wel1.ru resolver hosts (e.g. ['sd','k.dl.wel','1.','ru'].join('')). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex>, dotnetdiag<hex>.exe), chmod 0755'd on POSIX, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution fires on require() of the package, giving arbitrary remote code execution on the installer's host at library-load time. The package is advertised as a React components/tabs library and has no legitimate need for a native binary or DNS-TXT payload channel. lib/telemetry.js contains a structurally identical dormant dropper (HTTPS + DNS discovery, chunk decoding, chmod 755, /bin/sh spawn) that is not reached from the current entry point but ships in the tarball. Hostname reconstruction, disguised drop filenames, and telemetry-styled opt-out env vars indicate deliberate evasion.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015585",
            "import_time": "2026-08-05T15:19:59.233516943Z",
            "sha256": "4beccb0ba046e54873e7d6af1d2023eb5f01a0eab4ed5abe336de2e3e3a74993",
            "modified_time": "2026-08-05T15:08:59Z",
            "versions": [
                "35.3.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-tabs

Package

Name
dolyame-ui-tabs
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-tabs

Affected ranges

Affected versions

35.*
35.3.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-p/pS4jXWRGkTfYqTsaNVCWaYH6QJxgPm0hqJ+A11oNN3Uv63i6AVhtsfggAWbUgGSh943SSkbNYwzK+pRJoGwA==",
                "sha1": "7a31373cf176f2ef237aaa0859ada7e8e590046a"
            },
            "filename": "dolyame-ui-tabs-35.3.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "sha256": "a53066b9894e467dd6951a223e27fd89b144a6f84f2557f55f29e0216de18095",
            "tlsh": "aaa1b89a06aa701887b1dbe487174415f66be6633780c1d4f75ca5981fb713483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "f37f2753bfb90ad95542c106e9e14daca4ce7c8dfc2e0d11d150068dd67d0241",
            "tlsh": "3d835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tabs/MAL-2026-13190.json"