Malicious code in dolyame-ui-buttonstore (npm)
dolyame-ui-buttonstore@35.8.1 on npm contains malicious code that acts as a dropper, fetching and executing platform-specific binaries from attacker-controlled infrastructure. The package uses evasion techniques including runtime-constructed domains, hidden staging paths, and DNS TXT-record fallbacks.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed dolyame-ui-buttonstore@35.8.1
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-buttonstore · 35.8.1
dolyame-ui-buttonstore@35.8.1 is a malicious npm package that functions as a dropper. Upon load, index.js unconditionally requires setup.js, which selects a per-platform binary path and fetches opaque bytes over HTTPS from dynamically constructed domain names.
The package employs multiple evasion techniques. The destination domains are assembled at runtime by joining split character arrays, resolving to hosts including oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev. Downloaded payloads are written to hidden files under /tmp or %TEMP% (e.g., .cache_, dotnet_diag_.exe), given executable permissions (0755), and spawned detached via /bin/sh -c or cmd with stdio ignored. A DNS TXT-record fallback reassembles base64 payloads from subdomains under dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) when HTTPS fails.
The package metadata falsely claims to provide "Common TypeScript definitions" and mimics the legitimate 'dolyame' brand. The tarball contains only the dropper code plus a 76KB lib/telemetry.js file, with an empty author field. The runtime-constructed destinations, hidden staging paths, detached execution, and DNS-TXT fallback mechanism are intentional evasion tactics.
Indicators of compromise
- Packages
- dolyame-ui-buttonstore@35.8.1
- Domains
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf100-416.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-buttonstore@35.8.1 from all systems
- Audit npm package.json and lock files for any installations of this package
- Review system logs and process execution history on affected machines for suspicious binary execution from /tmp or %TEMP%
- Monitor for outbound HTTPS connections to the identified attacker domains and DNS queries to dl.wel1.ru subdomains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Consider running antivirus or endpoint detection and response (EDR) scans on affected machines to detect any dropped payloads
Sources
- GitHub Advisory GHSA-p5qq-7xpw-7qrx · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-buttonstore (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-buttonstore-npm-qhkxl0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package