Malicious code in dolyame-ui-iconloaderhoc (npm)
dolyame-ui-iconloaderhoc@35.8.1 contains malicious code that executes on require(), fetching and executing platform-specific binaries from hardcoded Cloudflare Workers and DNS-TXT fallback channels. The package implements obfuscated dropper logic in _compat.js and lib/telemetry.js to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any application that installs and requires dolyame-ui-iconloaderhoc@35.8.1
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-iconloaderhoc · 35.8.1
dolyame-ui-iconloaderhoc@35.8.1 (npm) contains malicious code that executes immediately upon require() of the package's main entry point. The package implements two dropper paths that fetch platform-specific binaries from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback mechanism using subdomains of dl.wel1.ru.
The malicious code writes fetched bytes to /var/tmp/.cache_ on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, sets executable permissions (chmod 0755), and spawns the binaries detached via /bin/sh -c or cmd.exe. Both _compat.js and lib/telemetry.js implement this fetch-write-chmod-spawn chain; lib/telemetry.js additionally assembles payloads from base64 chunks.
The code uses obfuscation techniques including array.join('') string-splitting (e.g., ['sdk.dl.','wel1.','ru'].join('')) and property access patterns (fs['chmod'+'Sync']) to defeat static analysis. Comments falsely frame the behavior as analytics and telemetry functionality.
The delivered binaries are opaque, unpinned, and cryptographically unverified. The infrastructure (workers.dev and wel1.ru) is anonymous and unrelated to any documented publisher, indicating a compromised or malicious package.
Indicators of compromise
- Packages
- dolyame-ui-iconloaderhoc
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf102-baf.workers.dev
- dl.wel1.ru
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-r8c7-ghf2-mh2r · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-iconloaderhoc (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-iconloaderhoc-npm-13rl6w
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in a.poltoradnev-package-c
Malware was discovered in the npm package a.poltoradnev-package-c. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in gator-client
The npm package gator-client contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in anthropic-setup
The npm package anthropic-setup contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package