Malicious code in dolyame-ui-inputtime (npm)
The npm package dolyame-ui-inputtime contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package masqueraded as a monitoring SDK but performed unauthorized code execution on installation.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed dolyame-ui-inputtime
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-inputtimenpm package containing malicious dropper code
The npm package dolyame-ui-inputtime was published with embedded malicious code designed to download and execute arbitrary binaries. Upon require(), the package loads a hidden loader module that fetches platform-specific executables from hardcoded Cloudflare Workers hosts (oob-worker.cf101-.workers.dev, oob-worker.cf102-.workers.dev, oob-worker.cf103-*.workers.dev) with a DNS-TXT covert-channel fallback using domains under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).\n\nThe dropper uses DNS TXT record queries to retrieve a chunk count and base64-encoded payload chunks, which are concatenated and decoded into executable binaries. These binaries are written to temporary directories (/tmp on POSIX, %TEMP% on Windows) under obfuscated names (.cache_ on POSIX, dotnet_diag_.exe on Windows), marked executable (chmod 0755), and spawned detached to survive the parent process termination.\n\nThe malicious logic is duplicated in lib/telemetry.js under an SDK_NAME='apm.node' cover. The package manifest falsely describes it as a "Monitoring and observability SDK" with no relation to the actual shipped behavior. Obfuscation techniques include runtime hostname reconstruction via array.join and dangerous API resolution through string concatenation (e.g., require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-inputtime
- Domains
- oob-worker.cf101-*.workers.dev
- oob-worker.cf102-*.workers.dev
- oob-worker.cf103-*.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-inputtime from all systems
- Audit npm package.json and lock files for any presence of dolyame-ui-inputtime
- Review process execution logs and network connections for suspicious activity to Cloudflare Workers hosts or *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Monitor for unexpected child processes or binary execution in /tmp or %TEMP% directories
- Update npm dependencies and use npm audit to identify any remaining malicious packages
Sources
- GitHub Advisory GHSA-v55h-m4jc-mhgh · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-inputtime (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-inputtime-npm-1un3wk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package