MAL-2026-13561

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-contextmenu/MAL-2026-13561.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13561
Published
2026-08-07T12:30:43Z
Modified
2026-08-07T13:20:32.537865494Z
Summary
Malicious code in dolyame-ui-contextmenu (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438)

On require() of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a temp path under cover-story names such as 'dotnetdiag_*.exe' and '.cache_*', chmods it 0755, and spawns it detached via cmd.exe or /bin/sh. Destination hostnames are assembled from array fragments (e.g. ["oob-w","orker.cf99-9b3.workers.de","v"].join("")) to evade static scanners, and a base64-over-DNS-TXT covert channel under *.dl.wel1.ru is used to fetch the payload when HTTPS is blocked. The destinations are anonymous Workers subdomains unrelated to any documented purpose of the package, and the delivered bytes are opaque attacker-controlled code executed on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438",
            "modified_time": "2026-08-07T12:30:43Z",
            "import_time": "2026-08-07T12:51:22.071864595Z",
            "id": "IN-MAL-2026-017010",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-contextmenu

Package

Name
dolyame-ui-contextmenu
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-contextmenu

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "d525b1a38db4c5de0644cd4c142e28e719ceebe08ceb79b3d73aadd6c40e9613",
            "path": "_polyfill.js",
            "tlsh": "6aa1c65a16fa70180a92e1d8851f9c16709bf69336c4d8d4fb4c66948fa752883b39fc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "086ec1d02992d20931f4989ae299852e5c22631e",
                "sha512_sri": "sha512-r9OHLQ2udI1aek9YvHgP6h+nEJRe0k/2nbHcgU7jSdFjDy2PYmS9OnI/oktcvIq1XmSQVtf8Js6KuTHwuG4f2g=="
            },
            "filename": "dolyame-ui-contextmenu-35.8.1.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-contextmenu/MAL-2026-13561.json"