Malicious code in dolyame-ui-focusstatehoc (npm)
The npm package dolyame-ui-focusstatehoc contains malicious code that downloads and executes platform-specific binaries from obfuscated Cloudflare Workers domains and Russian DNS fallback servers on package require. The attack uses string obfuscation to evade detection and provides multiple remote code execution paths disguised as telemetry.
- Disclosed
- Last updated
- Blast radius
- Any application that requires dolyame-ui-focusstatehoc; code execution occurs at package load time on all platforms (Linux x64/ARM64, macOS, Windows).
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-focusstatehocnpm package containing malicious bootstrap code
The npm package dolyame-ui-focusstatehoc was found to contain malicious code that executes automatically when the package is required. The attack is implemented across multiple entry points (_compat.js and lib/telemetry.js) and runs a bootstrap routine at load time.
The malicious code downloads platform-specific binaries (linux_x64, linux_arm64, darwin, win32.exe) from a shuffled list of obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), with DNS-TXT fallback to Russian domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The binary is written to temporary directories with disguised names (.cache_ on Unix, dotnet_diag_.exe on Windows), made executable, and spawned detached with no verification.
The attack uses runtime string concatenation to reconstruct sensitive API names and destination hosts, evading static analysis. The malicious behavior is framed as optional analytics/telemetry with environment variable opt-out flags. Additionally, lib/telemetry.js assembles and executes base64-encoded payloads via the same spawn/chmod mechanism, providing a second remote code execution path at load time.
The vulnerability affects all consumers of the package across all supported platforms, with code execution occurring automatically on require before any application logic runs.
Indicators of compromise
- Packages
- dolyame-ui-focusstatehoc
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove dolyame-ui-focusstatehoc from all dependencies and lock files
- Audit all systems that have installed this package for signs of compromise (process execution, network connections to Cloudflare Workers or wel1.ru domains, unexpected binaries in /tmp or %TEMP%)
- Review npm audit logs and package.json history to identify when this package was added
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update to a patched version if available, or replace with a legitimate alternative package
- Consider using npm package integrity verification tools and private package registries to prevent similar incidents
Sources
- GitHub Advisory GHSA-2q5m-3qcg-vf7g · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-focusstatehoc (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-focusstatehoc-npm-yzzvgc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in bolt-delivery-menu-app
The npm package bolt-delivery-menu-app contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in a.poltoradnev-package-a
The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in @junofficial/baileys
The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.
npmCompromised package - containedcritical
Malware in userbotjs
The npm package userbotjs contained malware that could fully compromise any system on which it was installed. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package