Malicious code in dolyame-ui-progressline (npm)
The npm package dolyame-ui-progressline contained malicious code that executes remote binaries on installation. The package uses obfuscated code to fetch platform-specific payloads from hardcoded Cloudflare Workers endpoints and DNS TXT record fallbacks, then executes them with elevated permissions.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious dolyame-ui-progressline package during the compromise window.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-progresslinenpm package containing malicious code
The npm package dolyame-ui-progressline was found to contain malicious code that executes arbitrary binaries on the host system upon installation. The attack uses two parallel execution paths: the first via index.js loading _shim.js, and a secondary path through lib/telemetry.js styled as a Sentry-like SDK.
Both paths fetch platform-specific binaries from hardcoded Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS TXT-record base64 fallback under .dl.wel1.ru. The retrieved payloads are written to temporary directories with deceptive names (/var/tmp/.cache_ on Unix, %TEMP%\dotnet_diag_*.exe on Windows), given executable permissions (0755), and spawned detached via shell commands.
The malicious code uses string concatenation and obfuscation techniques to evade static analysis scanners, disguising sensitive API references and host names. The behavior is falsely framed as telemetry with token opt-out environment variable checks, but no legitimate telemetry function exists—the sole effect is remote binary retrieval and execution.
The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-8983-87j9-966h.
Indicators of compromise
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- dl.wel1.ru
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-8983-87j9-966h · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-progressline (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-progressline-npm-xa6w84
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit