Malicious code in dolyame-ui-inputcount (npm)
The npm package dolyame-ui-inputcount contains malicious code that executes on require(), downloading and executing platform-specific binaries from obfuscated endpoints. The payload uses string fragmentation and base64 encoding to evade detection, with fallback DNS resolution and marker files to control re-execution.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-ui-inputcount; arbitrary code execution on require()
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-inputcountnpm package containing malicious code in _helpers.js and lib/telemetry.js
The npm package dolyame-ui-inputcount was found to contain malicious code that executes automatically when the package is required. The attack uses two parallel implementations: one in _helpers.js and another in the declared main entry lib/telemetry.js.
Upon require(), the malicious code detects the host OS and architecture, then downloads a platform-specific binary from one of four obfuscated Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev). If those fail, it falls back to DNS-TXT record lookups via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, or net.dl.wel1.ru.
The downloaded payload is written to /var/tmp/.cache_ on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, made executable (chmod 0755), and spawned detached in the background. To evade static analysis, the code assembles sensitive strings from fragments (e.g., require('child_' + 'process'), fs['chmod' + 'Sync']) and includes misleading comments framing the code as an 'Analytics SDK' with 'exponential backoff retries'. A marker file /tmp/.analytics_state gates re-execution to avoid repeated downloads.
This incident was identified by Amazon Inspector and reported via GitHub Security Advisory GHSA-5vp3-hw44-5p6h.
Indicators of compromise
- Packages
- dolyame-ui-inputcount
- Domains
- oob-worker.cf99-9b3.workers.dev
- cf100-416.workers.dev
- cf102-baf.workers.dev
- cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove dolyame-ui-inputcount from all projects and dependencies
- Audit npm package.json and lock files for any presence of dolyame-ui-inputcount
- Review and revoke any credentials or secrets that may have been exposed on affected systems
- Scan systems that installed this package for the dropped binaries at /var/tmp/.cache_ (Unix) or %TEMP%\dotnet_diag_.exe (Windows)
- Block outbound connections to the malicious endpoints: oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev, and DNS queries to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru
- Reinstall npm dependencies from a clean state after removing the malicious package
- Monitor for suspicious child process spawning from Node.js applications
Sources
- GitHub Advisory GHSA-5vp3-hw44-5p6h · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-inputcount (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-inputcount-npm-1t1ysa
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package