MAL-2026-13598

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-selectaccount/MAL-2026-13598.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13598
Published
2026-08-07T12:24:12Z
Modified
2026-08-07T13:20:54.612632006Z
Summary
Malicious code in dolyame-ui-selectaccount (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363)

On require() of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute dropper. The code selects a platform-tagged asset path (/pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe) and fetches it from string-split, obfuscated hostnames of the form oob-worker.cf1XX-XXX.workers.dev, with a DNS-TXT chunked-base64 fallback over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under disguised names (.cache<rand> or dotnetdiag<rand>.exe), chmodded to 0755 via fs["chmod"+"Sync"], and spawned detached with stdio ignored via cp.spawn("/bin/sh", ["-c", filePath + " &"], { detached: true, stdio: "ignore" }).unref() or cmd.exe /c start /b. Dangerous API names are assembled at runtime by string concatenation (require("child" + "process")) and the destination hostnames are reconstructed with Array.join to hide the C2 from static inspection. The 'Analytics SDK' / 'telemetry' framing does not correspond to the code's actual behavior, which is unconditional retrieval and execution of an attacker-controlled native binary on the installer's host at import time. No integrity check, pinning, or signature verification is performed on the downloaded payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.1"
            ],
            "id": "IN-MAL-2026-016966",
            "import_time": "2026-08-07T12:51:20.106027716Z",
            "modified_time": "2026-08-07T12:24:12Z",
            "source": "amazon-inspector",
            "sha256": "4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-ui-selectaccount

Package

Name
dolyame-ui-selectaccount
View open source insights on deps.dev
Purl
pkg:npm/dolyame-ui-selectaccount

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-ui-selectaccount/MAL-2026-13598.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-ui-selectaccount-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-I7njemB0eaTnqtd/baavV7sZnuAKge+6jfKnhnHYZOQr9nk2ne4WXFKUUjh6SaDOMC+FxLhZ+qpbHPfPBJLGCA==",
                "sha1": "c496a49d1d4e17a81ec362597c73a4008056178d"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "tlsh": "b3a1b61a12fb70284792e6d4851f5416729eea9332c4d8c4fb4c66548fa627983f39ec",
            "sha256": "9f357211560f752d5cd5b66c23973f779898903e21acf4b9dbcbd67b32364c1c"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "f373304966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9",
            "sha256": "0bbc11d9fda2abf4cb0bef9746d7373532664280813b333e18305650bdbc9ccb"
        }
    ]
}