Malicious code in dolyame-ui-inputtools (npm)
The npm package dolyame-ui-inputtools contains malicious code that downloads and executes arbitrary binaries from attacker-controlled infrastructure on require(). The package masquerades as a UI input tools library but implements a remote code execution payload via obfuscated child_process spawning.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-ui-inputtools; arbitrary code execution on require()
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-inputtoolsnpm package containing malicious code in index.js and lib/telemetry.js
The npm package dolyame-ui-inputtools contains malicious code embedded in index.js and lib/telemetry.js that executes arbitrary code when the package is required. On load, the code assembles URLs from string fragments pointing to attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf102-baf, cf99-9b3, cf101-adf) and domains under *.dl.wel1.ru, with a DNS TXT record covert channel fallback for command and control.\n\nThe malicious payload downloads executable binaries, writes them to temporary directories (/tmp or %TEMP%) under disguised filenames (.cache_, dotnet_diag_.exe), sets execute permissions (chmod 0755), and spawns them detached via child_process. The telemetry.js module obfuscates the child_process require and fs.chmodSync calls using string concatenation to evade static analysis. No cryptographic verification of downloaded content is performed.\n\nThe package name and stated purpose (UI input tools / analytics SDK) do not match the actual malicious behavior. This represents a direct supply chain compromise delivering arbitrary code execution to any consumer of the package.
Indicators of compromise
- Packages
- dolyame-ui-inputtools
- Domains
- oob-worker.cf100-416.workers.dev
- cf102-baf
- cf99-9b3
- cf101-adf
- dl.wel1.ru
Remediation
- Immediately remove dolyame-ui-inputtools from all projects and dependencies
- Audit npm package.json and lock files for any presence of dolyame-ui-inputtools
- Assume any system that installed or required this package may be compromised; review process execution logs and network connections for suspicious activity
- Block outbound connections to oob-worker.cf100-416.workers.dev, cf102-baf, cf99-9b3, cf101-adf, and *.dl.wel1.ru at the network perimeter
- Review DNS query logs for suspicious subdomain lookups under dl.wel1.ru
- Regenerate credentials and signing keys on any affected systems
- Monitor for indicators of the disguised executable filenames (.cache_, dotnet_diag_.exe) in /tmp and %TEMP% directories
Sources
- GitHub Advisory GHSA-8x86-rh4c-m9xf · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-inputtools (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-inputtools-npm-zzcrqy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit