Malicious code in dolyame-ui-popupcarousel (npm)
The npm package dolyame-ui-popupcarousel contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled infrastructure upon installation. The dropper executes unconditionally on require, granting arbitrary code execution to any system installing the package.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious dolyame-ui-popupcarousel package; arbitrary code execution on installer's host.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-popupcarouselnpm package containing malicious code
The npm package dolyame-ui-popupcarousel was found to contain malicious code designed to execute arbitrary binaries on the installer's system. Upon require of the package, two files (support.js and lib/telemetry.js) fetch platform-specific native binaries from rotating Cloudflare Workers hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback via *.dl.wel1.ru.\n\nThe malicious payload is written to temporary directories (/tmp or %TEMP%) under decoy filenames (.cache, dotnet_diag_.exe), given executable permissions (chmod 0755), and spawned detached via shell commands (/bin/sh -c or cmd.exe). Destination hostnames and sensitive API names are obfuscated via string-split-and-join techniques to evade static code inspection.\n\nThe main entry point unconditionally requires _support.js, meaning the dropper executes on any import of the package, regardless of whether the package's intended functionality is used. This grants arbitrary code execution on the installer's host under the guise of a 'telemetry SDK'.\n\nThe malicious package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-j84x-mpxc-246j.
Indicators of compromise
- Packages
- dolyame-ui-popupcarousel
- Domains
- oob-worker.cf100-*.workers.dev
- oob-worker.cf101-*.workers.dev
- oob-worker.cf102-*.workers.dev
- oob-worker.cf103-*.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-popupcarousel from all systems and projects
- Audit npm install logs to identify all systems that may have installed this package
- Assume any system that installed this package may be compromised; perform forensic analysis and consider full system remediation
- Review and revoke any credentials or sensitive data that may have been exposed on affected systems
- Update npm dependencies to remove any references to dolyame-ui-popupcarousel
- Monitor for suspicious outbound connections to oob-worker.cf10*.workers.dev and *.dl.wel1.ru domains
Sources
- GitHub Advisory GHSA-j84x-mpxc-246j · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-popupcarousel (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-popupcarousel-npm-1axvr4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package