MAL-2026-13192

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-test/MAL-2026-13192.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13192
Published
2026-08-05T15:08:52Z
Modified
2026-08-05T15:53:06Z
Summary
Malicious code in dolyame-ui-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d)

index.js unconditionally requires./platform on module load. platform.js reconstructs attacker-controlled hostnames via string-splitting (Array.join) to fetch a platform-specific native binary from one of four Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev). On HTTPS failure it falls back to a DNS-TXT covert channel under wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reading a chunk count from c. and reassembling base64-encoded payload chunks from N. TXT records. The fetched binary is written to /tmp or the Windows temp directory under decoy names (dotnet_diag*.exe,.cache*,.analytics_state), chmod 0755, and spawned detached/unref'd via /bin/sh -c or cmd.exe /c start /b. A second, currently-unreferenced dropper in lib/telemetry.js duplicates the same fetch->chmod->spawn pattern behind a 'telemetry SDK' cover story, using require("child_"+"process") and fs["chmod"+"Sync"] to further obfuscate dangerous APIs. A UI package has no legitimate reason for this behavior; the destination obfuscation, DNS-TXT fallback, decoy filenames, and parallel staged dropper module together fingerprint a supply-chain attack delivering full-host remote code execution to any installer that requires the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015584",
            "import_time": "2026-08-05T15:19:59.184636747Z",
            "modified_time": "2026-08-05T15:08:52Z",
            "sha256": "8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d",
            "source": "amazon-inspector",
            "versions": [
                "35.2.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-test

Package

Name
dolyame-ui-test
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-test

Affected ranges

Affected versions

35.*
35.2.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_platform.js",
            "sha256": "0f09d20c6d2461ae9c95dd671101be4c435e2ef69432de14bc0889b604e1af26",
            "tlsh": "4fa1a75a05a670098bb0e7e4c7175816f65bf66337c0c294f79c69885f7312482b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "bffb30c669600dbcb3eb43e3ec6f81b76ddbda3866d2643674852c7e8a67c631",
            "tlsh": "72835055566a602186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-test-35.2.5.tgz",
            "hashes": {
                "sha1": "ad244c053c53f051a5c83011d5892eaa31423f1b",
                "sha512_sri": "sha512-g3IPjHDSawwJ5/RAKWbomSP5qzuxKsvRYVEkJSOocA9LOoZSChT+jCzW078pZEydB2cW1IQuJnr8KMvR9zol4g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-test/MAL-2026-13192.json"