Malicious code in dolyame-ui-contextmenusearchable (npm)
The npm package dolyame-ui-contextmenusearchable contains malicious code that downloads and executes a platform-specific binary on require(). The package uses obfuscation techniques (string concatenation, base64 fallback DNS TXT records) to hide command-and-control infrastructure and masquerades as a data-transformation utility.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-ui-contextmenusearchable; arbitrary code execution on installation/require
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-contextmenusearchablenpm package containing malicious dropper code
The npm package dolyame-ui-contextmenusearchable was found to contain malicious code that executes on module import. The package includes two separate execution paths: _shim.js and lib/telemetry.js, both implementing a dropper chain that fetches and executes a binary payload.\n\nThe malicious code reconstructs hostnames via string concatenation to conceal destinations (oob-worker.cf*.workers.dev, with a DNS TXT-record base64 fallback under *.dl.wel1.ru). It downloads a platform-specific binary, writes it to /var/tmp/.cache_XXXX on Unix or %TEMP%\dotnet_diag_XXXX.exe on Windows (masquerading as a .NET diagnostic file), sets executable permissions (chmod 755), and spawns it detached with stdio ignored.\n\nDangerous API names such as "child_process" and "chmodSync" are reassembled at runtime via string concatenation to defeat static analysis. A TTL flag file suppresses re-execution. The package advertises itself as a data-transformation/analytics utility, but the fetched binary is opaque and delivery hosts are anonymous mutable Cloudflare Workers unrelated to any documented publisher.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-contextmenusearchable
- Domains
- oob-worker.cf*.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately remove dolyame-ui-contextmenusearchable from all npm dependencies and lock files
- Audit npm install logs and package-lock.json for any installation of this package
- Regenerate all credentials and secrets that may have been exposed on affected systems
- Scan systems that installed this package for unexpected binaries in /var/tmp/.cache_* (Unix) or %TEMP%\dotnet_diag_*.exe (Windows)
- Review process execution logs for suspicious spawned processes from Node.js
- Update to a patched version if available, or use an alternative package
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-rq48-5q5h-mq4j · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-contextmenusearchable (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-contextmenusearchable-npm-1i7tt6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package