MAL-2026-13591

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-overridestyles/MAL-2026-13591.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13591
Published
2026-08-07T12:26:01Z
Modified
2026-08-07T13:20:50.784020891Z
Summary
Malicious code in dolyame-ui-overridestyles (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72)

On require() of the package, _compat.js invokes a setup() routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked-base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a cover-named file under TMP or /var/tmp (e.g., dotnetdiag*.exe,.cache_*), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. A second dropper path in lib/telemetry.js (loaded via the package main) reconstructs an executable from base64 buffers, chmods 0755, and spawns via /bin/sh. Hostnames, the child_process require, and chmodSync are constructed by concatenation to evade static scanners. No hash or signature verification is performed on the downloaded payloads. The purpose is inconsistent with the package's presented name (a UI style-override library).

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.1"
            ],
            "id": "IN-MAL-2026-016978",
            "import_time": "2026-08-07T12:51:20.663868189Z",
            "modified_time": "2026-08-07T12:26:01Z",
            "source": "amazon-inspector",
            "sha256": "38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-overridestyles

Package

Name
dolyame-ui-overridestyles
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-overridestyles

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-overridestyles/MAL-2026-13591.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-overridestyles-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-DvVw6jtK5rCIijvUnms/7p+ssc1B8++++T5stxNC2/AeI+qBJmU/9iPFr4VMBLO3WHCIaKx4kftoiQ4gHAPpog==",
                "sha1": "294bece243b24fd2e0d2f99ad04ef41d1faba520"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "tlsh": "1ea1b75a06fa70180792a4d9852b5806b19ff95336c4d9c0fb4ca6a44faa13883b39fc",
            "sha256": "62f81fca34889e93a5c29b6f461392c8095253882ca78338ea473cf90bcf7db4"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "4f733f4966fb10214263b0685eab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9",
            "sha256": "befc06df96ce12a8224293d76e7c13caa0e160abe3b32a3036377d516fe6c8da"
        }
    ]
}