MAL-2026-13590

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-noindex/MAL-2026-13590.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13590
Published
2026-08-07T12:24:50Z
Modified
2026-08-07T13:20:49.516722628Z
Summary
Malicious code in dolyame-ui-noindex (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e)

On require(), index.js loads./ext which selects a platform-specific payload (linuxx64/arm64, darwin, win32), downloads an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru hosts whose names are reconstructed from split string arrays, writes it to /tmp or the Windows temp directory under a disguised name (a hidden.cache<hex> file or a dotnetdiag<hex>.exe lookalike), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-based fallback channel reassembles base64 payload chunks from numbered subdomains of ext.dl.wel1.ru / sdk.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru when HTTPS is blocked. The same drop-and-exec routine is duplicated in lib/telemetry.js, where the childprocess require is also split-string obfuscated. The package name resembles a legitimate UI library but the shipped code contains no such library — its only import-time effect is to fetch and execute an opaque remote binary.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:24:50Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016970",
            "import_time": "2026-08-07T12:51:20.318696661Z",
            "sha256": "dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-noindex

Package

Name
dolyame-ui-noindex
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-noindex

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-noindex-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-JnuGk0x83Xv5abjO0jzyQ6SJZc9nicFswh270ik1AiUJ2+0Vl85xvVPuG+QsVA3+NAOCyjKNsYy7ds6dxyBCJA==",
                "sha1": "733ed410706f41dea03c12f80cec20e9d07415b1"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "29a1955926fa30180792a1d4851f982671defa9333c5d8c4fb4ca5985f9b138c3f2aec",
            "sha256": "a0a624f60f7b065be242ef2530a5e8b1f2f139476682ee0c9e18b6ab079e65b9",
            "path": "_ext.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-noindex/MAL-2026-13590.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]