MAL-2026-13566

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-deprecatepropshoc/MAL-2026-13566.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13566
Published
2026-08-07T12:34:46Z
Modified
2026-08-07T13:20:35.639803586Z
Summary
Malicious code in dolyame-ui-deprecatepropshoc (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226)

On require(), dolyame-ui-deprecatepropshoc@35.8.1 side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments (['oob-worker.cf101-adf.','wor','kers.dev'].join('')) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, fetch a platform-specific opaque binary (/pkg/package, /pkg/loadermac, /pkg/package.exe), write it to /var/tmp/.cache<uid> or %TEMP%\dotnetdiag<uid>.exe, apply mode 0755 via fs['chmod'+'Sync'], and spawn it detached through /bin/sh -c or cmd.exe /c start /b. childprocess is loaded via require('child_'+'process') to evade static matching. There is no version pin, hash, or signature verification on the fetched executable. The dropper is duplicated inside lib/telemetry.js — the module referenced by index.js's module.exports — so the payload deploys even if adapter.js is removed. The 'telemetry'/'analyticsstate'/'dotnetdiag' naming is a cover story; the behavior is remote-code execution on the installer at require() time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226",
            "source": "amazon-inspector",
            "versions": [
                "35.8.1"
            ],
            "import_time": "2026-08-07T12:51:23.229826617Z",
            "modified_time": "2026-08-07T12:34:46Z",
            "id": "IN-MAL-2026-017037"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-deprecatepropshoc

Package

Name
dolyame-ui-deprecatepropshoc
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-deprecatepropshoc

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "bcf586f1fc78cb11ef0b7b43e4eb37f1bce425bd",
                "sha512_sri": "sha512-OZEO8YeYkoOTEwTtIPNDT8mRPMd02fZN2SHbQw0+YjWRdqrmN6hl5SncyFV/x41HzugOZyN9eh8JMItXT9AACw=="
            },
            "filename": "dolyame-ui-deprecatepropshoc-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "sha256": "a71bb282bb6f6dbb48943701be6fea3c81ac1811edd587926676e86ca41ebc96",
            "tlsh": "0da1a65926fa30180793b2e4841f4826719af69333c4e9d4fb4c66945fd663883b2afc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "280ab5ad96a8282e8b5480c5a2c0638c02eafc9631fe6190ea1c2811a052b068",
            "tlsh": "fd733f4966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-deprecatepropshoc/MAL-2026-13566.json"