MAL-2026-13593

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-popupcarousel/MAL-2026-13593.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13593
Published
2026-08-07T12:26:08Z
Modified
2026-08-07T13:20:51.798565676Z
Summary
Malicious code in dolyame-ui-popupcarousel (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6)

On require of the package, support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback via *.dl.wel1.ru, write the payload to /tmp or %TEMP% under decoy filenames (.cache<hex>, dotnetdiag<hex>.exe), chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. Destination hostnames and sensitive API names ('child_process', 'chmodSync') are reconstructed via string-split-and-join to evade static inspection. The main entry unconditionally require()s _support.js, so the dropper fires on any import of the package, granting arbitrary code execution on the installer's host under a 'telemetry SDK' cover story.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.1"
            ],
            "id": "IN-MAL-2026-016979",
            "import_time": "2026-08-07T12:51:20.710805572Z",
            "modified_time": "2026-08-07T12:26:08Z",
            "source": "amazon-inspector",
            "sha256": "2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-popupcarousel

Package

Name
dolyame-ui-popupcarousel
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-popupcarousel

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-vyFHJj+0ddXFKAGSubcwc5+Yr8NMpTHdwEheTdFToCLXJCSvrR3luMAoV9PJfP23z0YT/DhzUhFol9YnN9FXzw==",
                "sha1": "ef08101fceea78646098f3d80158d05abc4712f6"
            },
            "filename": "dolyame-ui-popupcarousel-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "tlsh": "1fa1d95a16fa70080693e4d5842f5816b19bf95332c4f9d0fb4ca6988f9a138c3b39fc",
            "sha256": "0fa40dff37137d6106f9b12943745ae82ab2ea1f3a4a451bf43987ee2d07b51c"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "f373304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9",
            "sha256": "7740348095bc39382f7e524be166a377eac7fb48f8f2397dc36f0a40a4ac68f6"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-popupcarousel/MAL-2026-13593.json"