Malicious code in dolyame-ui-pageheader (npm)
The npm package dolyame-ui-pageheader contained malicious code that downloads and executes arbitrary binaries from attacker-controlled Cloudflare Workers endpoints on load. Installation or requiring the package grants full remote code execution to the attacker.
- Disclosed
- Last updated
- Blast radius
- Any system installing or requiring the malicious dolyame-ui-pageheader package gains full remote code execution to the attacker.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-pageheadernpm package advertised as 'Common TypeScript definitions' but containing malicious code
The npm package dolyame-ui-pageheader was found to contain malicious code disguised as a TypeScript definitions library. Upon installation or require, the package's main entry point (index.js) unconditionally loads a malicious bridge.js module.\n\nThe bridge.js module selects a platform-specific payload path and fetches an opaque binary over HTTPS from one of four Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, cf102-baf, cf101-adf, cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback via *.dl.wel1.ru. The downloaded binary is written to /tmp or %TEMP% under disguised names (e.g., dotnet_diag.exe or .cache), given execute permissions (chmod 0755), and spawned detached via shell commands with no hash or signature verification.\n\nA redundant execution channel is present in lib/telemetry.js with identical fetch/write/chmod/spawn primitives. String obfuscation techniques (split arrays and string concatenation) were used to defeat static analysis. Any system installing or requiring this package grants full remote code execution to the operator of the workers.dev endpoints.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-pageheader
- Domains
- oob-worker.cf100-416.workers.dev
- cf102-baf.workers.dev
- cf101-adf.workers.dev
- cf103-070.workers.dev
- dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-pageheader from all systems
- Audit all systems that installed or required this package for signs of compromise or unauthorized binary execution
- Review network logs for connections to oob-worker.cf100-416.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev, or *.dl.wel1.ru
- Check /tmp and %TEMP% directories for suspicious files matching patterns like dotnet_diag_* or .cache_*
- Regenerate credentials and secrets on affected systems
- Monitor for any unauthorized processes or network activity originating from affected hosts
Sources
- GitHub Advisory GHSA-m9j5-hq2x-6cm7 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-pageheader (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-pageheader-npm-5n6ohy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malware in agent-bot-api
Malware was discovered in the npm package agent-bot-api. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malware in @zynkit/jwtbytes
Malware was discovered in the npm package @zynkit/jwtbytes, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in sugarball-cli
Malware was distributed via the sugarball-cli npm package, resulting in full system compromise of affected machines. The advisory recommends treating any system with this package as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package