MAL-2026-13577

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inputdate/MAL-2026-13577.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13577
Published
2026-08-07T12:35:58Z
Modified
2026-08-07T13:20:42.149918062Z
Summary
Malicious code in dolyame-ui-inputdate (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484)

On require()/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a base64-over-DNS-TXT fallback channel across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to a hidden temp file (.cache<rand> / dotnetdiag<rand>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd. Hostname reconstruction from split-string arrays and the DNS covert-channel fallback demonstrate deliberate evasion. The package's stated purpose ('API client wrappers') does not correspond to any of this behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:35:58Z",
            "id": "IN-MAL-2026-017045",
            "import_time": "2026-08-07T12:51:23.689822118Z",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector",
            "sha256": "338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-inputdate

Package

Name
dolyame-ui-inputdate
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-inputdate

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-inputdate-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-o6iBN06XsPjYP+3NDVh20o0A2H4wo267TaBm2DBhQC9Fwo9rGQzeHjAa6vs7L13YrNM1egdP3l1+nylbaUC4hA==",
                "sha1": "a25c59f82de6f58014544923916614d10c135993"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_ext.js",
            "tlsh": "92a1945916fa301507a2e5d8891f881a719ef99332c4d8d8fb4c6a948f96138c3f29fd",
            "sha256": "f6693cf04ead0ffc0844db6ab84a3bbc9f5a00046a7f7341837e32ebcd0fdeb9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inputdate/MAL-2026-13577.json"