MAL-2026-13509

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-lazyrender/MAL-2026-13509.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13509
Published
2026-08-07T12:12:32Z
Modified
2026-08-07T12:35:14.499538411Z
Summary
Malicious code in dolyame-ui-lazyrender (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419)

On require of dolyame-ui-lazyrender, _helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev hosts (with DNS-based fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the payload to a hidden temp file, applies chmod 0755, and detach-spawns it via /bin/sh -c "<path> &" or cmd.exe /c start /b. No hash or signature verification is performed and the destination hosts are unrelated to the package's declared purpose. A second, redundant dropper implementation in lib/telemetry.js (reached via the package's main entry point) reconstructs require("child_process") and fs["chmodSync"] from concatenated fragments, base64-decodes chunked transport data, chmods the extension file to 0755, and spawns it via /bin/sh -c. Hostnames and dangerous API names are assembled at runtime from split arrays (e.g. ["oob-worker.cf99-9b3.w","ork","ers.d","ev"].join(""), require("child_" + "process")) to evade static inspection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419",
            "source": "amazon-inspector",
            "import_time": "2026-08-07T12:23:25.661111444Z",
            "modified_time": "2026-08-07T12:12:32Z",
            "versions": [
                "35.8.1"
            ],
            "id": "IN-MAL-2026-016883"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-lazyrender

Package

Name
dolyame-ui-lazyrender
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-lazyrender

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "09582799eb12feeb4f9628bb184a7e47647d12b2",
                "sha512_sri": "sha512-PWmv2lkFnx4axFDtFKowRgCFSDzMKpzrR4tvovJ8CXebU216AhU3sm4k41qCpjcK1zhtKBfFFhn9uSnFWyv83Q=="
            },
            "filename": "dolyame-ui-lazyrender-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "sha256": "4d0fcdc130009f33beda01b61530b5f4ba9a5057680cbb0f7375335aac2d3c1b",
            "tlsh": "e4a1b65516fa300806a3e5d4861f9826719ee6633394d8d8ff4c66844fea178c3f25fc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "a6cc9860007a63719cbf4d473500e36428209c360107d0450ebe270be0e7aac5",
            "tlsh": "3473304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-lazyrender/MAL-2026-13509.json"