MAL-2026-13189
Malicious code in dolyame-ui-table (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e) On require of the package's main entry, `_compat.js` reconstructs Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev) and a DNS-TXT fallback discovery host (sdk.dl.wel1.ru) from split string arrays joined at runtime, downloads a platform-specific binary via https.get, writes it under /tmp or %TEMP% with disguised names (dotnet_diag_<rand>.exe,.cache_<rand>), chmods 0o755, and spawns it detached via `/bin/sh -c` or `cmd`. Staging paths and destinations are runtime-assembled to evade literal string matching, and the payload uses cover-story naming resembling system diagnostics. The package presents itself as a UI table toolkit, which has no need for native binary downloads or subprocess execution.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-ui-table (npm). Pin to a known-safe version or switch to an alternative.