Malicious code in dolyame-ui-inputtag (npm)
The npm package dolyame-ui-inputtag contained malicious code that downloads and executes platform-specific binaries from attacker-controlled endpoints. The package mimics the legitimate Dolyame payment UI namespace but functions as a fetch-and-execute delivery mechanism rather than a UI component.
- Disclosed
- Last updated
- Blast radius
- Any system that installed and required the dolyame-ui-inputtag package
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-inputtagnpm package containing malicious dropper code
The npm package dolyame-ui-inputtag was found to contain malicious code designed to download and execute attacker-controlled binaries. Upon requiring the package's main entry point, index.js loads _init.js which fetches platform-specific executables from hardcoded endpoints (oob-worker.*.workers.dev) with DNS-TXT chunked fallback over *.dl.wel1.ru subdomains.
The fetched binaries are written to temporary directories (/tmp or %TEMP%) under disguised names (.cache_, dotnet_diag_.exe), made executable, and spawned detached via shell commands (/bin/sh -c or cmd.exe). A second dropper path with identical functionality exists in lib/telemetry.js. The malicious code uses runtime string concatenation and array-join techniques to reconstruct endpoint hostnames and API names, evading static analysis.
Execution is rate-limited via a time-based lock file (approximately every 6 hours) and respects opt-out environment variable checks. The package name was chosen to mimic the legitimate Dolyame payment UI namespace, but the shipped code is purely a delivery mechanism for remote code execution, not a functional UI component.
Indicators of compromise
- Domains
- oob-worker.cf103-070.workers.dev
- dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-inputtag from all affected systems
- Audit systems that installed this package for signs of unauthorized binary execution or persistence mechanisms
- Review process logs and network connections from the time of installation for suspicious activity
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update dependency manifests (package.json, package-lock.json) to remove this package
- Implement npm package scanning and verification in CI/CD pipelines to detect typosquatting and malicious packages
Sources
- GitHub Advisory GHSA-gx3q-hwq5-v832 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-inputtag (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-inputtag-npm-1g19yy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package