MAL-2026-13571

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-generateid/MAL-2026-13571.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13571
Published
2026-08-07T12:23:57Z
Modified
2026-08-07T13:20:38.572571305Z
Summary
Malicious code in dolyame-ui-generateid (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf)

On require() of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev, with a covert DNS TXT-record fallback that reads chunk counts from c.<domain> and base64 payload fragments from N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under disguised names such as.cache<rand> or dotnetdiag<rand>.exe, chmodded 0755 on POSIX, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start. A second import-reachable dropper path exists in lib/telemetry.js: it decodes base64 chunks into a Buffer, invokes fs["chmod"+"Sync"] with mode 0o755, and calls cp.spawn("/bin/sh", ["-c", filePath+" &"]). Anti-analysis techniques include split-string require("child_"+"process"), split-property fs["chmod"+"Sync"], array-join hostname assembly, and DNS TXT-record staged payload delivery. The package's stated purpose (a UI ID-generation helper / observability SDK) does not require fetching and executing native binaries from anonymous Cloudflare Workers domains.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-07T12:51:20.041775734Z",
            "sha256": "1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf",
            "versions": [
                "35.8.1"
            ],
            "modified_time": "2026-08-07T12:23:57Z",
            "id": "IN-MAL-2026-016964",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-generateid

Package

Name
dolyame-ui-generateid
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-generateid

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "43c8cde7143e1bafbab501aa85c2ea285fa2b98f",
                "sha512_sri": "sha512-Efj5Fuwwn6NX+4anH6geec4p4LJ4kcj5OwxXk9RvgUcGg8asu9IydKM+7FwNLxUouzrcZf2S52VIfUlKYhYvGA=="
            },
            "filename": "dolyame-ui-generateid-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_shim.js",
            "sha256": "f17a9dd050c9f8563680b48802201182fb2d3b4d30581adac1a086f34c489370",
            "tlsh": "8ba1865916fa70180792e5d8841f9416b19be69332c4e8c4fb4c6a948fe7279c3b39fc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "2ab911b995b44d63d9e9e224253e743f05c1ff041b1c8fc4570b340deb8f1825",
            "tlsh": "ab733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-generateid/MAL-2026-13571.json"