Malicious code in dolyame-ui-contenteditable (npm)
The npm package dolyame-ui-contenteditable contained malicious code that downloads and executes binaries from attacker-controlled Cloudflare Workers and DNS-TXT fallback channels upon require(). The package used obfuscation techniques including string concatenation, base64 encoding, and anti-analysis measures to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any project that installed dolyame-ui-contenteditable; code execution on require()
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-contenteditablenpm package containing malicious code in index.js and lib/telemetry.js
The npm package dolyame-ui-contenteditable was found to contain malicious code in its index.js and lib/telemetry.js files. Upon require() of the package, the code unconditionally loads /_compat.js, which reassembles attacker-controlled Cloudflare Workers hostnames from split string literals (oob-worker.cf101-adf.workers.dev family).
The malware selects OS/arch-specific remote paths, downloads binaries, and writes them to temporary directories (/tmp or %TEMP%) under disguised names such as dotnet_diag_.exe or .cache_. The files are then made executable (chmod 0755 on POSIX systems) and spawned detached via /bin/sh -c or cmd.
A secondary fallback mechanism uses DNS-TXT-record chunked-base64 retrieval from *.dl.wel1.ru subdomains (e.g., sdk.dl.wel1.ru) to reassemble binary bytes when HTTPS egress is blocked. A parallel dropper in lib/telemetry.js uses string concatenation and base64 decoding to achieve similar execution under an Analytics SDK/telemetry cover story.
The malware employed multiple anti-analysis techniques including no version pinning, no hash verification, opt-out environment variable checks, and TTL stamp files to evade detection and analysis.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Domains
- oob-worker.cf101-adf.workers.dev
- sdk.dl.wel1.ru
- dl.wel1.ru
Remediation
- Immediately remove dolyame-ui-contenteditable from all projects and dependencies
- Audit all systems where this package was installed for signs of unauthorized binary execution or persistence mechanisms
- Review process execution logs and network connections to oob-worker.cf101-adf.workers.dev and *.dl.wel1.ru domains
- Check /tmp and %TEMP% directories for suspicious files matching patterns like dotnet_diag_* or .cache_*
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm lockfiles and reinstall dependencies from trusted sources
- Monitor for any indicators of compromise from the identified C2 infrastructure
Sources
- GitHub Advisory GHSA-fg9g-p4w9-9xxc · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-contenteditable (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-contenteditable-npm-68zxju
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package