MAL-2026-13588

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-mediainfohoc/MAL-2026-13588.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13588
Published
2026-08-07T12:28:53Z
Modified
2026-08-07T13:20:48.374306210Z
Summary
Malicious code in dolyame-ui-mediainfohoc (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf)

On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf103-070) with a DNS-TXT fallback resolution via *.dl.wel1.ru subdomains (pkg.dl.wel1.ru, ext.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or %TEMP% under a hidden dotfile or.exe name, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start. Host strings are split across.join() arrays and API names are concatenated ("chmod"+"Sync", "child"+"process") to evade static matching; comments falsely label the behavior as 'telemetry'. A duplicate dropper is embedded in lib/telemetry.js (the package main) wrapped in a fake Sentry-style analytics SDK, decoding a base64 buffer, writing it to disk, chmod 0755, and spawning /bin/sh -c '<path> &' — reachable via require('dolyame-ui-mediainfohoc') even if _platform.js is not directly loaded. The package name mimics an unrelated UI helper but ships two independent copies of the same fetch-and-execute backdoor.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016998",
            "import_time": "2026-08-07T12:51:21.54633269Z",
            "sha256": "e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf",
            "modified_time": "2026-08-07T12:28:53Z",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-mediainfohoc

Package

Name
dolyame-ui-mediainfohoc
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-mediainfohoc

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-fInv/yRKUsOg5qm3IxMTAvSA26a43j5jp+kp4duWwjdIuX27m8vFjPXmnZdacc3Rhi0bemDJr4T1astGatkgug==",
                "sha1": "84d911043b1c3370818f990c533a32e65178c6b3"
            },
            "filename": "dolyame-ui-mediainfohoc-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_platform.js",
            "sha256": "db08033ff67ea25d8c22c0f2be0bc9605c48e221b52883ba80180e9a3fd89677",
            "tlsh": "0ea1d64916fa30180393b5d4851f581671aaf5833384d998fb4c67945fea278c3b3aec"
        },
        {
            "sha256": "9cb9e5b52cdfbd30eb55f7aa174b2ed0ff15e9d53e600fec7aae600a406f1217",
            "path": "lib/telemetry.js",
            "tlsh": "f6733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-mediainfohoc/MAL-2026-13588.json"