MAL-2026-13191

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tag/MAL-2026-13191.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13191
Published
2026-08-05T15:09:16Z
Modified
2026-08-05T15:53:05.800608591Z
Summary
Malicious code in dolyame-ui-tag (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c)

On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from split string fragments (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT covert-channel fallback via subdomains of dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written under a decoy name (dotnetdiag_*.exe on Windows,.cache_* on Unix) to %TEMP%/ /tmp, chmodded 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or cp.spawn('cmd.exe', ['/c','start','/b',fp]). A second dropper of the same shape is present in lib/telemetry.js and uses split identifiers (require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis. Hostname obfuscation, DNS-TXT fallback for HTTPS-blocked environments, decoy filenames, detached execution, and a bundled backup dropper are consistent with a supply-chain attack delivering attacker-controlled code to installer machines on any install or require of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T15:19:59.294994986Z",
            "id": "IN-MAL-2026-015587",
            "versions": [
                "35.9.9"
            ],
            "sha256": "62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:09:16Z"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-tag

Package

Name
dolyame-ui-tag
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-tag

Affected ranges

Affected versions

35.*
35.9.9

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tag/MAL-2026-13191.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "e9a1759a16aa701d8bb0e7e486175415f65be6633380c2d4f75ca9881fb612483b2efc",
            "path": "_ext.js",
            "sha256": "131cbc4a03ad796d3d805052b66f3f1d37270a47ef76034c95a84fc9dbe4264c"
        },
        {
            "tlsh": "f3835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "path": "lib/telemetry.js",
            "sha256": "1a6acfc0e42b06237589ad9c2adae9333773affb994c37f2642810bff79627f2"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-tag-35.9.9.tgz",
            "hashes": {
                "sha1": "cec4445b4b31e27b7fb05cc4d1f4550a280c3c48",
                "sha512_sri": "sha512-mm9eu2frnGVB+yMIPeQoSzpeIfh7eYFwC+lJ8E9pb08kN/zVOSO7moWMwUeLzXmTV4y3dfpdBHWHCuTdfBjXMQ=="
            }
        }
    ]
}