Malicious code in dolyame-ui-dataqa (npm)
The npm package dolyame-ui-dataqa contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled infrastructure. The package masqueraded as a UI/data-QA utility while performing unauthorized code execution on installation.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed dolyame-ui-dataqa
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-dataqanpm package containing malicious loader-dropper code
The npm package dolyame-ui-dataqa was found to contain malicious code designed to download and execute native binaries without user consent. Upon require of index.js, the package loads polyfill.js and lib/telemetry.js, which fetch platform-specific executables from Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS TXT fallback to *.dl.wel1.ru.\n\nThe malicious code employs evasion techniques including runtime assembly of destination hostnames and child_process module names from split-string arrays to avoid detection by static analysis tools. Downloaded binaries are written to temporary directories (/tmp or %TEMP%) under innocuous filenames (.cache, dotnet_diag_.exe), made executable (chmod 0755), and spawned detached via shell commands.\n\nRedundancy is built into the attack: lib/telemetry.js contains a duplicate write-chmod-spawn execution path encoded in base64 buffers, ensuring execution even if _polyfill.js is removed or detected. The package's stated purpose as a UI/data-QA utility does not align with its actual loader-dropper behavior.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-dataqa
- Domains
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-dataqa from all systems
- Audit npm package.json and lock files for any presence of dolyame-ui-dataqa
- Review system logs and process execution history for suspicious child processes spawned from Node.js
- Check /tmp and %TEMP% directories for suspicious files matching patterns .cache_* or dotnet_diag_*.exe
- Monitor network traffic for connections to oob-worker.cf*.workers.dev and *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm dependencies and use npm audit to identify other potentially compromised packages
Sources
- GitHub Advisory GHSA-p7c9-vmrf-f5wm · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-dataqa (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-dataqa-npm-14g67l
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in userbotjs-jun
The npm package userbotjs-jun was found to contain malware, potentially providing full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in cloud-agen-bot
The npm package cloud-agen-bot contains malware that grants full control of affected systems to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in autoai
The npm package autoai was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately, and the package should be removed.
npmCompromised package - containedcritical
Malware in @junofficial/baileys
The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.
npmCompromised package