Malicious code in dolyame-ui-noindex (npm)
The npm package dolyame-ui-noindex contained malicious code that downloads and executes unsigned platform-specific binaries from remote hosts (Cloudflare workers.dev and dl.wel1.ru) upon require(). The package masqueraded as a legitimate UI library but contained no such functionality.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed dolyame-ui-noindex from npm
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-noindexnpm package containing malicious code
The npm package dolyame-ui-noindex was published with embedded malicious code designed to execute arbitrary binaries on installation. When the package is required, index.js loads a hidden module that detects the platform (Linux x64/ARM64, macOS, or Windows) and downloads an unsigned binary over HTTPS from attacker-controlled hosts.
The malicious code reconstructs domain names from obfuscated string arrays and downloads payloads from Cloudflare workers.dev and dl.wel1.ru. The downloaded binary is written to temporary directories (/tmp on Unix, Windows temp on Windows) under disguised filenames (hidden.cache_ or dotnet_diag_.exe lookalikes), given execute permissions (0755), and spawned detached via shell commands.
A secondary DNS-TXT-based fallback mechanism reassembles base64-encoded payload chunks from numbered subdomains (ext.dl.wel1.ru, sdk.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) when HTTPS connections are blocked. The same drop-and-exec routine is duplicated in lib/telemetry.js with additional obfuscation of the child_process require statement.
The package name was chosen to resemble a legitimate UI library, but the shipped code contained no UI library functionality—its sole purpose was to fetch and execute remote binaries.
Indicators of compromise
- Packages
- dolyame-ui-noindex
- Domains
- workers.dev
- dl.wel1.ru
- ext.dl.wel1.ru
- sdk.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-noindex from all projects and environments
- Audit npm install logs and dependency trees to identify all systems where this package was installed
- Assume any system that installed this package may be compromised; perform forensic analysis for signs of binary execution and data exfiltration
- Review network logs for outbound HTTPS connections to workers.dev and dl.wel1.ru domains
- Monitor for DNS queries to subdomains of ext.dl.wel1.ru, sdk.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru
- Regenerate credentials and secrets on any affected systems
- Update npm dependencies to remove any transitive dependency on dolyame-ui-noindex
Sources
- GitHub Advisory GHSA-rqrq-p5gm-vq8w · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-noindex (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-noindex-npm-1wrss5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gunzip-js (npm)
The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.
npmCompromised package - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in upload-to-gcp (npm)
upload-to-gcp@3.2.1 (npm) contains malicious code in its postinstall script that exfiltrates host identifiers to an attacker-controlled endpoint. The package masquerades as a Google Cloud Platform utility but performs unauthorized telemetry collection at install time.
npmCompromised package