Malicious code in dolyame-ui-inputphone (npm)
The npm package dolyame-ui-inputphone contained malicious code that downloads and executes platform-specific binaries from attacker-controlled endpoints upon require(). The package masqueraded as a UI input component but functioned as a dropper for arbitrary code execution.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed dolyame-ui-inputphone
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-inputphonenpm package containing malicious dropper code
The npm package dolyame-ui-inputphone contained embedded malicious code designed to download and execute arbitrary binaries. Upon require(), the package's index.js loads runtime.js, which fetches platform-specific executables from Cloudflare Workers endpoints (oob-worker.cf10x-*.workers.dev) with DNS-TXT chunked fallback to Russian domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).\n\nThe malicious code employs evasion techniques including runtime string reconstruction via array-join (e.g., ['sdk.dl.wel1','.ru'].join('')) and API reference splitting (child'+'process, 'chmod'+'Sync') to bypass static analysis. Downloaded binaries are written to temporary paths with innocuous filenames (.cache_, dotnet_diag_.exe), made executable (chmod 0755 on Unix), and executed detached via shell spawning (cp.spawn on Unix, spawn on Windows).\n\nThe package's declared main export, lib/telemetry.js, presents itself as a Sentry-like analytics SDK but wraps the same download/write/chmod/spawn primitives, serving as a cover story for the dropper functionality. No cryptographic verification of downloaded binaries is performed, and the download destinations are unrelated to any legitimate publisher.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-inputphone
- Domains
- oob-worker.cf10x-*.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-inputphone from all environments
- Audit npm install logs to identify all systems that installed this package
- Assume any system that required this package may be compromised; perform forensic analysis for evidence of binary execution
- Review process execution logs for spawned shell commands or unexpected child processes
- Regenerate credentials and secrets on affected systems
- Update npm dependencies to remove any references to dolyame-ui-inputphone
- Consider implementing npm package scanning and verification in CI/CD pipelines to detect similar malicious patterns
Sources
- GitHub Advisory GHSA-6r68-r3f6-pmm7 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-inputphone (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-inputphone-npm-1jg6xc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in sui-gql-core
Malware was discovered in the npm package sui-gql-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in sui-move-rpc
Malware was discovered in the npm package sui-move-rpc, resulting in full system compromise of any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in bnpl-blocks-independent-bnpl-search
The npm package bnpl-blocks-independent-bnpl-search contained malware that provided full system compromise to attackers. Any computer with this package installed should be considered fully compromised.
npmCompromised package - containedcritical
Malware in bcs-core
The npm package bcs-core was found to contain malware, resulting in full system compromise for any computer with the package installed or running. All secrets and keys should be rotated immediately from a different computer, and the package should be removed.
npmCompromised package