Malicious code in dolyame-ui-inlineedit (npm)

The npm package dolyame-ui-inlineedit was found to contain malicious code that executes unconditionally when the package is required. The malicious payload is split across setup.js and lib/telemetry.js, with lib/telemetry.js serving as the package's module.exports, ensuring execution on any ordinary require() call.

The dropper fetches platform-specific binaries from attacker-controlled infrastructure, including Cloudflare Workers subdomains (oob-worker.cf10{0-3}-*.workers.dev) and DNS TXT fallback domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). Hostnames are assembled at runtime via array.join() to evade static analysis. The downloaded binaries are written to hidden paths under /var/tmp on Unix-like systems or as disguised.exe on Windows, with permissions set to 0755 via obfuscated fs["chmod"+"Sync"] calls.

The binaries are executed detached through /bin/sh -c on Unix or cmd.exe on Windows using .unref() to prevent process blocking. No signature or hash verification is performed on the fetched bytes. The package includes deceptive comments referencing SHA-256 integrity checks and environment variable opt-outs (DISABLE_TELEMETRY, DO_NOT_TRACK) to mimic legitimate telemetry, masking the malicious intent.

The incident was identified and credited to the OpenSSF malicious-packages repository.