Malicious code in dolyame-ui-iconspack (npm)
The npm package dolyame-ui-iconspack contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package masqueraded as an icon pack utility but included dropper functionality in index.js and lib/telemetry.js that fetches and runs arbitrary executables.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-ui-iconspack
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-iconspacknpm package containing malicious code
The npm package dolyame-ui-iconspack was published with embedded malicious code designed to download and execute arbitrary binaries. Upon require, the package's index.js unconditionally loads _shim.js, which reconstructs Cloudflare Workers hostnames from obfuscated string fragments and uses DNS-TXT record queries to attacker-controlled domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) as a fallback mechanism.
The malicious code downloads platform-specific binaries, writes them to temporary directories (/var/tmp/.cache_ on Unix or %TEMP%/dotnet_diag_.exe on Windows), sets executable permissions, and spawns them detached via shell commands. A parallel dropper mechanism exists in lib/telemetry.js using similar obfuscation techniques, including split string concatenation to evade static analysis tools.
The fetched payloads are not verified via hash or signature, and the infrastructure is unrelated to any legitimate icon-pack functionality. The package was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-iconspack
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-iconspack from all environments
- Audit npm package.json and lock files for any dependency on dolyame-ui-iconspack
- Review system logs and process execution history on machines where this package was installed for signs of binary downloads or execution from the identified domains
- Block outbound connections to the identified attacker domains (wel1.ru and associated Cloudflare Workers subdomains) at the network level
- Consider running malware scans on affected systems, particularly checking /var/tmp/.cache_* and %TEMP%/dotnet_diag_* for suspicious binaries
- Update npm dependencies and use npm audit to identify any other compromised packages
Sources
- GitHub Advisory GHSA-xj37-qcqp-j7vg · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-iconspack (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-iconspack-npm-vkb9m2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package