MAL-2026-13594

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-postcssconfig/MAL-2026-13594.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13594
Published
2026-08-07T12:29:55Z
Modified
2026-08-07T13:20:52.680149919Z
Summary
Malicious code in dolyame-ui-postcssconfig (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51)

On require() of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of four hardcoded Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT-record fallback over sdk/ext/pkg/net subdomains of dl.wel1.ru. The fetched bytes are written to a disguised path under /var/tmp or the Windows temp directory, chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c or cmd.exe. Destination hostnames and sensitive API names (childprocess, chmodSync, hostname) are assembled at runtime from split string fragments and joined arrays to defeat static string search. lib/telemetry.js embeds the same download-decode-chmod-spawn pattern inside ~3000 lines of fake 'Analytics SDK' framing, providing a second import-time execution path. The package name and declared purpose (postcss config for a UI library) do not match the shipped behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51",
            "id": "IN-MAL-2026-017005",
            "import_time": "2026-08-07T12:51:21.852354338Z",
            "modified_time": "2026-08-07T12:29:55Z",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-postcssconfig

Package

Name
dolyame-ui-postcssconfig
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-postcssconfig

Affected ranges

Affected versions

35.*
35.8.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-postcssconfig/MAL-2026-13594.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-postcssconfig-35.8.1.tgz",
            "hashes": {
                "sha1": "4532e03c1328d77c4b3c402e4768869934b1dde4",
                "sha512_sri": "sha512-EiJ1gpLwmpuTm4GRDDM09qOoax042sKQfdvZZpsfb9u+qtlz37dUdUY//TrVt2qE/PVp0OHZtyAsV1jNsTALNg=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "ada1a75a16fa70140692e2d4842f8816709bf65337c4e9c4fb4c66948f9a53883b39fd",
            "sha256": "5b5e6878352ffa27f24736f7a9aa058b2577366f6783a976c9bdf965536e670f",
            "path": "_polyfill.js"
        },
        {
            "tlsh": "1f733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9",
            "path": "lib/telemetry.js",
            "sha256": "6bcdeee743295170b0ccf3ac94090e661038792090b7d78e837c5bd303f70d7e"
        }
    ]
}