MAL-2026-13173
Malicious code in dolyame-ui-pie (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6f473b4f8898130c8b57fd3a129bf81a38b449ea8970e58a6e4c486943eb5579) Requiring the package triggers async initialization in _support.js that downloads a platform-specific binary (linux x64/arm64, darwin, win32) from Cloudflare Workers hosts and *.dl.wel1.ru mirrors whose hostnames are assembled at runtime via array.join("") string splits, with a DNS-TXT fallback resolver for the same domain family (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or TEMP/dotnet_diag_<rand>.exe on Windows, chmodded 0755, and spawned detached via /bin/sh -c or cmd /c start. child_process is loaded via require("child_" + "process") and fs.chmodSync via fs["chmod" + "Sync"] to evade static scanners. The package advertises itself as a React UI component library; none of this behavior relates to that purpose. Attacker-controlled binaries with disguised on-disk names (dotnet_diag,.cache_) execute on every require() of the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-ui-pie (npm). Pin to a known-safe version or switch to an alternative.