Malicious code in dolyame-ui-eventoutside (npm)
The npm package dolyame-ui-eventoutside contains malicious code that downloads and executes arbitrary binaries from attacker-controlled infrastructure upon require(). The package masquerades as an API client wrapper but grants the attacker arbitrary code execution on any machine that installs or imports it.
- Disclosed
- Last updated
- Blast radius
- Any system installing or importing the dolyame-ui-eventoutside package
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-eventoutsidenpm package containing malicious code
The npm package dolyame-ui-eventoutside was found to contain malicious code that executes on package import. When the package is required, a bootstrap script (_bootstrap.js) selects a platform-specific URL and downloads a binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with DNS-TXT-based fallback channels via wel1.ru subdomains.
The malicious payload is written to a disguised temporary path—on Windows as dotnet_diag_.exe and on Unix as .cache_—given executable permissions (0755), and spawned detached through cmd.exe or /bin/sh. Destination hostnames are obfuscated using split-string arrays (e.g., ["oob-worker.cf103-070.wo","rke","rs.de","v"].join("")) to evade static inspection, and the dropped file is named to masquerade as a .NET diagnostics artifact or hidden cache file.
The package's advertised purpose is to provide API client wrappers. Fetching and executing arbitrary attacker-controlled binaries is unrelated to this purpose and provides the attacker with arbitrary code execution on any machine that installs or imports the package.
This incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dolyame-ui-eventoutside
- Domains
- oob-worker.cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-eventoutside from all systems
- Audit npm install logs to identify all machines that have installed this package
- Scan affected systems for the presence of dotnet_diag_*.exe (Windows) or .cache_* (Unix) files in temporary directories
- Review network logs for connections to oob-worker.cf*.workers.dev and wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru)
- Assume code execution occurred on any system that installed the package and perform forensic analysis
- Update npm dependencies to remove any references to dolyame-ui-eventoutside
- Consider rotating credentials and secrets on affected systems
Sources
- GitHub Advisory GHSA-5gfg-rg6m-6h38 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-eventoutside (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-eventoutside-npm-1xctxt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit