Malicious code in dolyame-ui-selectaccount (npm)
The npm package dolyame-ui-selectaccount contained malicious code that downloads and executes attacker-controlled native binaries on the host system at import time. The dropper uses obfuscated C2 hostnames and DNS-TXT fallback channels to retrieve platform-specific payloads.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious dolyame-ui-selectaccount package; execution occurs at require() time on all platforms (Linux, macOS, Windows).
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-selectaccountnpm package containing malicious dropper code
The npm package dolyame-ui-selectaccount was found to contain malicious code in its index.js and lib/telemetry.js files. Upon require(), the package loads a dropper that unconditionally downloads and executes attacker-controlled native binaries.\n\nThe malicious code selects platform-specific asset paths (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and fetches them from obfuscated C2 hostnames of the form oob-worker.cf1XX-XXX.workers.dev, with DNS-TXT chunked-base64 fallback over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /var/tmp or Windows TEMP under disguised filenames (.cache_ or dotnet_diag_.exe), made executable via fs.chmodSync(0755), and spawned detached with stdio ignored.\n\nDangerous API names and C2 hostnames are obfuscated through runtime string concatenation and Array.join to evade static analysis. The package falsely frames itself as an 'Analytics SDK' or 'telemetry' library, but performs no integrity checks, pinning, or signature verification on downloaded payloads. Execution occurs at import time on all platforms (Linux, macOS, Windows).\n\nThe incident was discovered and credited to the OpenSSF.
Indicators of compromise
- Domains
- oob-worker.cf1XX-XXX.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-selectaccount from all systems and projects.
- Audit npm package.json and lock files for any presence of this package.
- Scan systems that installed this package for suspicious processes, network connections, and files in /var/tmp or Windows TEMP directories with names matching .cache_ or dotnet_diag_ patterns.
- Review system logs for unexpected child process spawning via /bin/sh or cmd.exe.
- Regenerate any credentials or secrets that may have been exposed on affected systems.
- Update to a clean version of any legitimate dependencies that may have been replaced by this malicious package.
- Monitor for indicators of compromise from the identified C2 domains and DNS servers.
Sources
- GitHub Advisory GHSA-9ccv-c933-88f3 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-selectaccount (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-selectaccount-npm-3rgcez
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit