Malicious code in dolyame-ui-flatcorners (npm)
The npm package dolyame-ui-flatcorners contained malicious code that downloads and executes OS-specific binaries from obfuscated third-party endpoints upon require/import. The dropper logic was duplicated across multiple modules to ensure execution and used string obfuscation to evade static detection.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed dolyame-ui-flatcorners; systems running affected applications could execute arbitrary OS-level binaries.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-flatcornersnpm package containing malicious code in _adapter.js and lib/telemetry.js
The npm package dolyame-ui-flatcorners was found to contain malicious code that executes on package import. The malicious code is present in both adapter.js and the advertised main module lib/telemetry.js, ensuring execution even if one path is blocked.\n\nUpon require() or import, the package downloads an OS-specific binary from obfuscated third-party endpoints hosted on Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The binary is written to /var/tmp/.cache on Unix or %TEMP%\dotnet_diag_.exe on Windows, marked executable, and spawned detached.\n\nThe malicious code uses runtime string concatenation and obfuscation techniques to evade static analysis detection. Hostnames, filesystem API names, and child_process require strings are reassembled at runtime. The fetched payload is opaque, unpinned, unverified, and unrelated to the package's stated purpose of providing TypeScript definitions.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dolyame-ui-flatcorners
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-flatcorners from all projects and systems
- Audit npm install logs and dependency trees to identify all affected applications
- Review system logs on machines that installed this package for evidence of binary downloads or execution from the identified domains
- Block outbound connections to the identified Cloudflare Workers and wel1.ru domains at the network level
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update to a clean version of any legitimate package that dolyame-ui-flatcorners was intended to replace, if applicable
Sources
- GitHub Advisory GHSA-rvh2-vch3-vqmc · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-flatcorners (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-flatcorners-npm-19u17d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package