MAL-2026-13565

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-datatable/MAL-2026-13565.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13565
Published
2026-08-07T12:34:27Z
Modified
2026-08-07T13:20:09.029833372Z
Summary
Malicious code in dolyame-ui-datatable (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33)

The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru, writes it to /tmp or Windows TEMP with an innocuous name (dot-prefixed cache file or dotnetdiag<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at runtime from split-string arrays joined with.join(''), and require('childprocess') is likewise assembled as require('child_' + 'process') to evade static matching. A second equivalent dropper path exists in lib/telemetry.js (also reachable via package main), providing redundant execution of arbitrary fetched bytes. The package is named 'dolyame-ui-datatable' with description 'Shared configuration and helpers' but contains no UI or datatable code — only the loader and dropper — consistent with a typosquat/dependency-confusion carrier. No signature or hash verification is performed on the downloaded payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.1"
            ],
            "id": "IN-MAL-2026-017035",
            "import_time": "2026-08-07T12:51:23.099262295Z",
            "sha256": "730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33",
            "modified_time": "2026-08-07T12:34:27Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-datatable

Package

Name
dolyame-ui-datatable
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-datatable

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "f063976da0951c9ad21b07946e79d46c8038e5a1b8e11977c2b7d0a95b07c977",
            "path": "_platform.js",
            "tlsh": "55a1a55a26fa301803a2e0e9852b5416719af65333c4d9d4fb0c66d44feb578c3b39ec"
        },
        {
            "sha256": "77c6b7f4bddece3c047faf682b91229751e14f9722eebe5e878d69c0f60670cb",
            "path": "lib/telemetry.js",
            "tlsh": "6f733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"
        },
        {
            "sha256": "12c7e2674f6c95614f4c0011abff4549e750cbc780db177bfaabd23d0939e4e2",
            "path": "package.json",
            "tlsh": "ffd02e380aa2983328c883130d16c49277309f6b10407c0c23cf682d03ae27379fb30d"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "64c138c6842f38d1de5014d3de40aa9d3e1c0f0a",
                "sha512_sri": "sha512-rIj1WImscw3puln2EWpwlQ0Djyp8KVMkMaO/wS9guMeHuAyzIVtbhqthnY/EovLC4Ms8agjQNVogzxJGGGsyvA=="
            },
            "filename": "dolyame-ui-datatable-35.8.1.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-datatable/MAL-2026-13565.json"