Malicious code in dolyame-ui-attachfile (npm)
The npm package dolyame-ui-attachfile contained malicious code that downloads and executes platform-specific native binaries from hardcoded Cloudflare Workers and DNS domains without user consent or verification. The package impersonates a fintech service while functioning as an anonymous dropper.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed the malicious dolyame-ui-attachfile package; systems running affected applications would execute arbitrary native binaries.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-attachfilenpm package impersonating fintech service; contains native binary loader with no verification
The npm package dolyame-ui-attachfile was found to contain malicious code that executes on package import. The main entry point (index.js) loads modules that implement an import-time dropper mechanism.\n\nThe malicious modules download opaque binary payloads from three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with DNS-TXT fallback to domains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The downloaded payloads are written to temporary directories (/var/tmp or %TEMP%) under disguised names (dotnet_diag_.exe, .cache_), made executable, and spawned detached via shell commands.\n\nThe package name impersonates a fintech service (dolyame) while the shipped code is an anonymous native-binary loader with no hash or signature verification and no user consent mechanism. Obfuscation techniques including string concatenation and API name fragmentation were used to evade static analysis.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-13504).
Indicators of compromise
- Packages
- dolyame-ui-attachfile
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf100-416.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-attachfile from all environments
- Audit npm package.json and lock files for any presence of this package
- Review system logs and process execution history on any systems where this package was installed for signs of binary execution
- Block outbound connections to the identified Cloudflare Workers hosts and wel1.ru DNS domains at network perimeter
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Consider full system reimaging for any production systems that installed this package
Sources
- GitHub Advisory GHSA-wwqm-fv8r-cwj6 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-attachfile (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-attachfile-npm-10tr2a
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package