Malicious code in dolyame-ui-clickoutsidehoc (npm)
The npm package dolyame-ui-clickoutsidehoc contains obfuscated malicious code that acts as a dropper, fetching and executing attacker-controlled native binaries on installation. The package mimics a legitimate UI utility but ships no such functionality.
- Disclosed
- Last updated
- Blast radius
- Any host that installs or imports the package
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-clickoutsidehocMalicious npm package masquerading as a UI HOC utility
The npm package dolyame-ui-clickoutsidehoc was published with malicious code designed to execute arbitrary native code on any system that installs or imports it. Upon require(), the package's index.js loads _shim.js, which uses obfuscated string assembly to hide command-and-control hostnames.
The malicious code fetches platform-specific executables from Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback to domains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded binary is written to /tmp or %TEMP% under disguised names (dotnet_diag_.exe or .cache_), given execute permissions (0755), and spawned detached via /bin/sh -c or cmd.
The package name was chosen to mimic legitimate UI HOC (Higher-Order Component) utilities, but the shipped code contains no such functionality—it is purely an obfuscated dropper for remote code execution. The incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dolyame-ui-clickoutsidehoc
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-clickoutsidehoc from all systems and projects
- Audit npm package.json and lock files for any presence of this package
- Review system logs and process execution history on any host where this package was installed for signs of unauthorized binary execution
- Check for suspicious processes spawned from /bin/sh or cmd with names matching dotnet_diag_* or .cache_*
- Monitor network traffic for connections to oob-worker.cf*.workers.dev or dns queries to *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-93pw-3cqq-jx36 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-clickoutsidehoc (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-clickoutsidehoc-npm-1iugsq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package