MAL-2026-13573

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inlineedit/MAL-2026-13573.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13573
Published
2026-08-07T12:26:35Z
Modified
2026-08-07T13:20:39Z
Summary
Malicious code in dolyame-ui-inlineedit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f)

The package presents itself as a data-transformation/UI utility but on require() unconditionally loads setup.js and lib/telemetry.js, both of which implement an install/import-time dropper. Hostnames are assembled at runtime via array.join() to evade static analysis, resolving to Cloudflare Workers subdomains under oob-worker.cf10{0-3}-*.workers.dev with a DNS TXT fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded, written to a hidden path under /var/tmp (or a disguised.exe on Windows), permissions are set to 0755 via bracket-access fs["chmod"+"Sync"], and the binary is spawned detached through /bin/sh -c or cmd.exe with.unref(). The fetched bytes are opaque with no signature or hash verification. lib/telemetry.js replicates the same primitives inside base64-decoded chunks and is the package's module.exports, so ordinary require() of the package triggers execution. Cover-story comments referencing SHA-256 integrity checks and DISABLE_TELEMETRY/DO_NOT_TRACK opt-outs are inserted alongside the dropper to mimic legitimate telemetry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016982",
            "import_time": "2026-08-07T12:51:20.806885081Z",
            "modified_time": "2026-08-07T12:26:35Z",
            "sha256": "944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f",
            "source": "amazon-inspector",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-inlineedit

Package

Name
dolyame-ui-inlineedit
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-inlineedit

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "f154ff0b333b63e63c1d4165ecfa89bd164c2eb278bd45dae0a474ef8552a2bb",
            "tlsh": "37a1a75516fab0290692e1d4841f8826719ef98337c5e5c4fb8c56588fd7128c3b3ded"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "258fbc7318628fc04dc476b64197fbb169313f9825266731f6e7f7610dc377ee",
            "tlsh": "2873304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-ui-inlineedit-35.8.1.tgz",
            "hashes": {
                "sha1": "9518b475f91c55644ae71580480ca20a38e8b2e9",
                "sha512_sri": "sha512-i618l2OCZe54HAZu0E1jzG+xzp/e/3fDQ0EPGCdGqs0hnl088oUyVh65uKarRg1Atgq0QmClfsMxKrO8bBh6Ug=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inlineedit/MAL-2026-13573.json"