MAL-2026-13197

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tooltip/MAL-2026-13197.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13197
Published
2026-08-05T15:07:35Z
Modified
2026-08-05T15:53:09.201877388Z
Summary
Malicious code in dolyame-ui-tooltip (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0fa2102880c7088cf1644fc7731a7fc59b6406477c1939e2dbc0382e8724ad20)

The package advertises itself as a tooltip UI component but its main entry (index.js) unconditionally requires./adapter, which at load time selects a platform-specific endpoint, downloads an opaque binary from obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to sdk.dl.wel1.ru, writes it to a temp path under decoy names such as dotnetdiag<hex>.exe or.cache<hex>, chmods it 0755 on POSIX, and detach-spawns it via cmd.exe or /bin/sh -c. Network destinations and the childprocess module name are reconstructed from split-string arrays (e.g. ['sdk.dl.we','l1','.r','u'].join(''), require('child' + 'process')) to hide them from static inspection. A UI tooltip library has no legitimate need for network I/O, child_process, or execution of unsigned remote binaries; the telemetry/analytics self-labeling is a cover story for full-host remote code execution against the installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:07:35Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015576",
            "import_time": "2026-08-05T15:19:58.825279953Z",
            "sha256": "0fa2102880c7088cf1644fc7731a7fc59b6406477c1939e2dbc0382e8724ad20",
            "versions": [
                "35.8.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-tooltip

Package

Name
dolyame-ui-tooltip
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-tooltip

Affected ranges

Affected versions

35.*
35.8.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-tooltip-35.8.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-wNyTrIqZsACujCuDpng4pCo5Jx0e6oce0FbiHSYmThWrhRQnr9mZNL8RgLqOoZE8eHi/oiboge66fmJmlZZclA==",
                "sha1": "9157da91fa81a1683f42332f0e76dc1d14c27169"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "eda1755a06a670188bb0ebe0c717482af65ef6633781c294fb9c65945f735248372efc",
            "sha256": "37be52102a1091a9789dac16dfeb24f41ca25f165a8588d2ee82be31141a49fc",
            "path": "_adapter.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-tooltip/MAL-2026-13197.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]