MAL-2026-13582

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inputsearch/MAL-2026-13582.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13582
Published
2026-08-07T12:33:28Z
Modified
2026-08-07T13:20:44.876089914Z
Summary
Malicious code in dolyame-ui-inputsearch (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe)

dolyame-ui-inputsearch@35.8.1 is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror list of Cloudflare workers.dev endpoints (oob-worker.cf103-070.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev) from string-concatenation-split literals, with a DNS-TXT fallback resolving base64-encoded download data via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded, written to a hidden path (/var/tmp/.cache<hex> on Unix, TEMP/dotnetdiag<hex>.exe on Windows), chmod 0755 on Unix, then spawned detached via /bin/sh -c or cmd. Endpoints and filenames are split-literal obfuscated and gated behind cover-story flags named analyticsstate and DISABLETELEMETRY, and the dropped filename impersonates.NET diagnostics tooling. The purpose of the fetched binary is opaque; the delivery mechanism has no hash or signature verification, no pinning, and no publisher-matched host. The purpose (dropper of an anonymous remote binary) is unrelated to the advertised UI input search functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe",
            "source": "amazon-inspector",
            "versions": [
                "35.8.1"
            ],
            "import_time": "2026-08-07T12:51:22.868615773Z",
            "modified_time": "2026-08-07T12:33:28Z",
            "id": "IN-MAL-2026-017029"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-inputsearch

Package

Name
dolyame-ui-inputsearch
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-inputsearch

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "5da73e15dbaa2a32b26df904d94235ca8978c275",
                "sha512_sri": "sha512-2vt8ozQfAtJCZwI2r/ppIqNNgerj17+juyunVSQMNlImzbnYQlVSQ5gkq2pdWJhQ+xtDgKdY0LRM3uKHbwNi6A=="
            },
            "filename": "dolyame-ui-inputsearch-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "71c95a504d2248d7c09e4db4fd4174f20161c4e0d87cf803ac25dc93f74ab2b5",
            "tlsh": "aea1a65a06fa30184793e1d8861f5816b1daf5533285e8c4fb4c66944fea27883f39fc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-inputsearch/MAL-2026-13582.json"