MAL-2026-13505

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-iconloaderhoc/MAL-2026-13505.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13505
Published
2026-08-07T12:13:18Z
Modified
2026-08-07T12:35:09.250921615Z
Summary
Malicious code in dolyame-ui-iconloaderhoc (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932)

On require() of the package's main entry, dolyame-ui-iconloaderhoc@35.8.1 executes two dropper paths that fetch platform-specific binaries from hardcoded Cloudflare workers.dev endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback channel via subdomains of dl.wel1.ru, write the bytes to /var/tmp/.cache<hex> or %TEMP%\dotnetdiag_<hex>.exe, chmod them to 0755, and spawn them detached via /bin/sh -c or cmd.exe. Both compat.js and lib/telemetry.js implement the fetch-write-chmod-spawn chain; lib/telemetry.js additionally assembles the payload from base64 chunks. Sinks and hostnames are constructed via array.join('') string-splitting (e.g. ['sdk.dl.','wel1.','ru'].join(''), require('child' + 'process'), fs['chmod'+'Sync']) to defeat static scanners, while comments frame the behavior as analytics/telemetry. The delivered bytes are opaque, unpinned, and unverified, and the workers.dev / wel1.ru destinations are anonymous infrastructure unrelated to any documented publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016889",
            "import_time": "2026-08-07T12:23:25.866363301Z",
            "sha256": "812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-07T12:13:18Z"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-iconloaderhoc

Package

Name
dolyame-ui-iconloaderhoc
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-iconloaderhoc

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_compat.js",
            "tlsh": "b7a1a55a16fa70180792e5d9841f8816b09af98337c5d8c4fb4c66948feb128c3b29fc",
            "sha256": "9317fd2cad89807d51eda00a0805b050d3088e006589a8bf6cc69b42e1e43591"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "f573304966fb1021826370685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9",
            "sha256": "838384c08f39772cde0881f9d6b9beb0c5f6e74b79b2e081d109668b8d8c99b4"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-iconloaderhoc-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-nEd+7Mk+zwuhDKYQcuso4nfil6KFLUfZSzR8tYlTry/MkOr+/XIeDDkzW7iMlQE3UJbqHaTAlfZIUXMm6n00Kw==",
                "sha1": "d03f6ca1cf9550738ca6d8debdfeda4cab486c45"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-iconloaderhoc/MAL-2026-13505.json"