MAL-2026-13199

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-utils/MAL-2026-13199.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13199
Published
2026-08-05T15:07:54Z
Modified
2026-08-05T15:53:09.582846851Z
Summary
Malicious code in dolyame-ui-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199)

On require of the package, polyfill.js selects a platform-keyed URL, fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a base64-chunked DNS-TXT fallback channel over *.dl.wel1.ru, writes it to /tmp/.cache<hex> or %TEMP%\dotnetdiag<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. No hash or signature verification is performed and destinations are unrelated to the package publisher. lib/telemetry.js ships a parallel dropper implementation with additional evasion (split require("child_"+"process"), dynamic fs["chmod"+"Sync"]) as staged secondary payload. An analyticsstate marker file and DISABLETELEMETRY env var provide cover framing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:07:54Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:58.884294032Z",
            "versions": [
                "35.6.7"
            ],
            "id": "IN-MAL-2026-015578",
            "sha256": "899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-utils

Package

Name
dolyame-ui-utils
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-utils

Affected ranges

Affected versions

35.*
35.6.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "ada1b76a06a670098bb0d7e5c6175416f65bf6637380d6d4fb9ca5880ff212483b2efc",
            "path": "_polyfill.js",
            "sha256": "b9c0388657ec00bc6063a2bec6da99db652ff397bc2f29f232f050bfa00e713e"
        },
        {
            "tlsh": "f5835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "path": "lib/telemetry.js",
            "sha256": "62fc8c36118095891d653b6f904658f5c31f3b00ac36f24f34e92fa6d21dd245"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "11682c1739644baabdd1011d45a531807d6c43a8",
                "sha512_sri": "sha512-C04tFUw2YhVgTfrPvNH3jaE5CXkDgR23Tj000Xm9o+DG0UgeJJrVm4DSuBys25BBjbwzINuL7oHAt4ILd9yNuQ=="
            },
            "filename": "dolyame-ui-utils-35.6.7.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-utils/MAL-2026-13199.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]