MAL-2026-13568
Malicious code in dolyame-ui-eventoutside (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a) On require() of dolyame-ui-eventoutside, _bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS-TXT-based fallback channel via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to a disguised temp path (Windows: dotnet_diag_<hex>.exe; Unix:.cache_<hex>), chmods it 0755, and spawns it detached and unref'd through cmd.exe or /bin/sh. Destination hostnames are reassembled from split-string arrays (e.g. ["oob-worker.cf103-070.wo","rke","rs.de","v"].join("")) to defeat static inspection, and the dropped file is named to masquerade as a.NET diagnostics artifact (dotnet_diag_) or a hidden cache file (.analytics_state /.cache_). The package's advertised purpose is API client wrappers; fetching and executing arbitrary attacker-controlled binaries is unrelated to that purpose and gives the publisher arbitrary code execution on any machine that installs or imports the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-ui-eventoutside (npm). Pin to a known-safe version or switch to an alternative.