Malicious code in dolyame-ui-inputbox (npm)
The npm package dolyame-ui-inputbox contained malicious code that acts as a remote binary dropper, fetching and executing platform-specific binaries from attacker-controlled endpoints. The package used obfuscation techniques to evade static analysis, including runtime string assembly and base64 encoding.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-ui-inputbox
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-inputboxnpm package containing malicious code
The npm package dolyame-ui-inputbox was found to contain malicious code designed to download and execute arbitrary binaries on affected systems. Upon package import, the code loads index.js, _loader.js, and lib/telemetry.js, which together implement a remote binary dropper mechanism.
The malicious code uses several evasion techniques to avoid detection. Hostnames and dangerous API calls are assembled at runtime from fragmented strings (e.g., joining arrays to form oob-worker.cf101-adf.workers.dev, or dynamically constructing require("child_" + "process") and fs["chmod" + "Sync"]). The loader fetches platform-specific binaries from *.workers.dev endpoints, with a DNS-TXT base64-encoded fallback to *.dl.wel1.ru domains.
The downloaded binaries are written to temporary directories (/tmp or TEMP) under disguised filenames such as .cache_ or dotnet_diag_.exe, given executable permissions (chmod 0755), and then spawned detached via shell commands (/bin/sh -c or cmd.exe /c start /b). A parallel dropper in lib/telemetry.js base64-decodes chunks, applies executable permissions, and spawns the resulting file.
The package's stated purpose of "Build and deployment tools" bears no legitimate relationship to fetching and executing platform-specific binaries, and the combination of hostname obfuscation, dynamic API assembly, and the network-write-execute chain are characteristic of malicious supply chain compromise.
Indicators of compromise
- Domains
- oob-worker.cf101-adf.workers.dev
- *.workers.dev
- *.dl.wel1.ru
Remediation
- Remove dolyame-ui-inputbox from all projects immediately
- Audit npm dependencies for any versions of dolyame-ui-inputbox and purge them
- Review system logs and process execution history on any systems where this package was installed for signs of binary execution
- Check for unexpected files in /tmp, TEMP, and other temporary directories with names like .cache_ or dotnet_diag_*
- Monitor for outbound connections to *.workers.dev and *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm lockfiles and reinstall dependencies from a clean state
Sources
- GitHub Advisory GHSA-v8m6-gp8m-c68v · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-inputbox (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-inputbox-npm-1uwuuh
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in harmony-app-toolkit (npm)
The npm package harmony-app-toolkit version 22.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with domains associated with malicious activity and executes commands consistent with malicious behavior.
npmCompromised package - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in depcruise-fmt (npm)
The npm package depcruise-fmt version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
npmCompromised package - containedcritical
Malicious code in depcruise-baseline (npm)
The npm package depcruise-baseline version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
npmCompromised package