Malicious code in dolyame-ui-collapseblock (npm)
The npm package dolyame-ui-collapseblock contained malicious code in _shim.js that fetches and executes OS-specific native binaries from attacker-controlled Cloudflare Workers hosts or via DNS-TXT covert channels, with no verification or user consent.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed dolyame-ui-collapseblock
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-collapseblocknpm package containing malicious _shim.js loader
The npm package dolyame-ui-collapseblock was found to contain malicious code in its _shim.js module. Upon require(), the module fetches OS/architecture-specific native binaries from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). The hostnames are reconstructed at runtime via array-join to evade static inspection.
The fetched payload is written to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised names (.cache_ on Unix, dotnet_diag_.exe on Windows), given execute permissions (0755), and spawned detached via /bin/sh -c or cmd. If HTTPS fetches fail, the loader falls back to a DNS-TXT covert channel using subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, retrieving and reassembling base64-encoded binaries from sequentially-numbered TXT records.
The malicious code is automatically executed when index.js requires _shim on load, with no version pinning, hash verification, or signature validation. A 21028-second cache gate and undocumented environment variables for operator opt-out are consistent with hostile dropper tradecraft rather than legitimate functionality.
The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Advisory GHSA-x579-hcjj-4fp2.
Indicators of compromise
- Packages
- dolyame-ui-collapseblock
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-collapseblock from all environments
- Audit all systems where this package was installed for unauthorized native binary execution or persistence mechanisms
- Review process logs and network traffic for connections to oob-worker.cf*.workers.dev or dns queries to *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update dependency manifests to remove this package and use a legitimate alternative for UI collapse functionality
- Monitor for similar malicious packages with obfuscated native binary loaders
Sources
- GitHub Advisory GHSA-x579-hcjj-4fp2 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-collapseblock (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-collapseblock-npm-1a3r2q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package