MAL-2026-13504

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-attachfile/MAL-2026-13504.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13504
Published
2026-08-07T12:15:14Z
Modified
2026-08-07T12:35:11.508143462Z
Summary
Malicious code in dolyame-ui-attachfile (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8)

On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a platform-specific asset path, download opaque bytes from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, write the payload to /var/tmp or %TEMP% under a disguised name (dotnetdiag_*.exe,.cache_*), chmod 0755, and spawn it detached via /bin/sh -c or cmd /c start. Destination hostnames and DNS domains are reconstructed at runtime from split-string arrays joined together, and API names are broken up (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static scanners. The package name impersonates a fintech (dolyame) while its shipped code is an anonymous native-binary loader with no hash or signature verification and no user consent. The Cloudflare Workers hosts and.dl.wel1.ru domains are not documented first-party endpoints for the package's stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.1"
            ],
            "id": "IN-MAL-2026-016902",
            "import_time": "2026-08-07T12:23:26.470744541Z",
            "modified_time": "2026-08-07T12:15:14Z",
            "source": "amazon-inspector",
            "sha256": "94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-attachfile

Package

Name
dolyame-ui-attachfile
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-attachfile

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-attachfile-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-wdDJuiPe4QeNSKjyCqdpLeX/4m5jy3IXPefi6Q0sLEumTtC/xy4GCc0fAwX7LmFmkVxjgr2ebLg5Q2kkHPKcdA==",
                "sha1": "daef27c6ac0ae2bedebf3a24fc9190e72a43725f"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_shim.js",
            "tlsh": "13a1965916fa70180692f5d8851f8816719ef69337c9d898fb4c66888fe712483b2dfc",
            "sha256": "93a05ae11456f71af8f9a3d8434dc58a6367c0dcd78a6e23faba761a51046e23"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "47733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9",
            "sha256": "3cc48169870bb9a71b0110fe066f8e583a68a935aabd3d45bd9bc5d22d4d5c0f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-attachfile/MAL-2026-13504.json"