Malicious code in dolyame-ui-carouselline (npm)
The npm package dolyame-ui-carouselline contained malicious code that executes remote code on package installation. The payload fetches platform-specific executables from attacker-controlled domains and executes them with elevated privileges.
- Disclosed
- Last updated
- Blast radius
- Any project that installed dolyame-ui-carouselline
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-carousellinenpm package containing malicious code
The npm package dolyame-ui-carouselline was found to contain malicious code that executes automatically when the package is required. The malicious code is distributed across index.js, _support.js, and lib/telemetry.js.
Upon package load, the code reconstructs attacker-controlled hostnames from string arrays and DNS-TXT records (including oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, and domains under dl.wel1.ru). It then fetches a platform-specific executable payload over HTTPS, with a base64-encoded DNS-TXT fallback channel.
The fetched payload is written to temporary directories (/var/tmp on Unix or %TEMP% on Windows) under disguised filenames (.cache_ or dotnet_diag_.exe), made executable (chmod 0755), and spawned as a detached process. Dangerous APIs are obfuscated through runtime string concatenation (e.g., require("child_" + "process")) to evade static analysis. A TTL-based state file gates repeated execution to reduce observability.
The malicious code is duplicated in lib/telemetry.js, wrapped in a fake analytics/telemetry SDK facade, ensuring the remote code execution path fires independently of other components.
Indicators of compromise
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf100-416.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Remove dolyame-ui-carouselline from all projects immediately
- Audit npm install logs and package-lock.json files to identify all installations of this package
- Assume any system that installed this package has been compromised; perform forensic analysis and remediation
- Check /var/tmp and %TEMP% directories for suspicious executables with names matching .cache_ or dotnet_diag_ patterns
- Monitor network traffic to the identified attacker domains for any outbound connections
- Regenerate all credentials and secrets that may have been exposed on affected systems
- Update npm dependencies and verify no other malicious packages are present
Sources
- GitHub Advisory GHSA-2gw7-39gj-2g68 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-carouselline (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-carouselline-npm-1q4om4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit