MAL-2026-13557

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkablegroup/MAL-2026-13557.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13557
Published
2026-08-07T12:36:06Z
Modified
2026-08-07T13:20:32.324854838Z
Summary
Malicious code in dolyame-ui-checkablegroup (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97)

The package presents itself as a UI checkable-group helper but on require executes a dropper. _helpers.js and the main-exported lib/telemetry.js assemble destination hostnames at runtime from split-string arrays (e.g. ["oob-worker.cf1","00-416.work","er","s.dev"].join("") yielding oob-worker.cf100-416.workers.dev, plus cf101-adf and cf103-070 siblings), select a platform-specific endpoint, download an opaque binary via https.get, write it to /tmp or %TEMP% under a spoofed name mimicking a Microsoft diagnostic tool (dotnet_diag_<hex>.exe, .cache_<hex>), chmodSync 0755, and spawn it detached via cp.spawn("/bin/sh",["-c", filePath+" &"], {detached:true}) on Unix or cmd.exe /c start /b on Windows. A covert DNS-TXT fallback channel under *.dl.wel1.ru reassembles a base64 payload from numbered subdomains (c.<domain> for count, <i>.<domain> for chunks). No hash or signature verification is performed. The dropper is duplicated across _helpers.js and the main-exported lib/telemetry.js, ensuring execution on any require of the package. Hostname obfuscation via split-string concatenation, spoofed on-disk names, detached execution, and the DNS-TXT covert channel are consistent with purpose-built malware distributed as a UI-helper lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017046",
            "versions": [
                "35.8.1"
            ],
            "modified_time": "2026-08-07T12:36:06Z",
            "import_time": "2026-08-07T12:51:23.739124106Z",
            "sha256": "ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-checkablegroup

Package

Name
dolyame-ui-checkablegroup
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-checkablegroup

Affected ranges

Affected versions

35.*
35.8.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-checkablegroup/MAL-2026-13557.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_helpers.js",
            "tlsh": "44a1735916fa70180792e0d8852fa416719ef59372c4d8d4fb8c6a984fe7228c3b39fc",
            "sha256": "d051af3a58cb08db09b2e4a0a4f9530a205200a592e973be01cb523031d3d6d9"
        },
        {
            "sha256": "730f8b1bcba564ecdedd133600e3e0cb509cd9bb30ed582fb002e9dd634996bf",
            "tlsh": "8e73304966fb10214263b0685ebb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9",
            "path": "lib/telemetry.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-checkablegroup-35.8.1.tgz",
            "hashes": {
                "sha1": "385c475a176cba1f2697aebe9a1794f48b4fc114",
                "sha512_sri": "sha512-sO+XVDKhmxaRwD0dEjsN9zRcjAOFUSqPnqZILmemiIvyFzDqJDKFQ+Iv7gNl7686l4RhUqV81kL86eASdBNFQg=="
            }
        }
    ]
}