MAL-2026-13555
Malicious code in dolyame-ui-cardlogo (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d) On load, index.js require()s _polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via string-array concatenation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback resolving to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched binary is written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are assembled from split string arrays, temp filenames imitate legitimate diagnostic tooling, and helper functions carry 'telemetry'/'analytics' cover-story naming with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks — none of this behavior relates to the package's stated UI purpose.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-ui-cardlogo (npm). Pin to a known-safe version or switch to an alternative.