Malicious code in dolyame-ui-sortablelist (npm)
The npm package dolyame-ui-sortablelist contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on package import. The malicious behavior was disguised as telemetry/analytics and could be bypassed via environment variables.
- Disclosed
- Last updated
- Blast radius
- All npm installations of dolyame-ui-sortablelist that execute the package code
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-sortablelistnpm package containing malicious code
The npm package dolyame-ui-sortablelist contained embedded malicious code that executes on require(). Upon import, the package fetches platform-specific executables from obfuscated Cloudflare Workers hosts (oob-worker.cf10{0..3}-*.workers.dev) with a fallback mechanism that reassembles a base64 payload from DNS TXT records under multiple attacker-controlled domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).
The downloaded binary is written to a temporary file disguised as OS diagnostics output (dotnet_diag_.exe on Windows, .cache_ elsewhere), made executable via chmod 0755, and spawned detached via shell invocation. The malicious logic is duplicated in lib/telemetry.js (the package's declared main entry point) to ensure execution even if other code paths are bypassed. The package uses obfuscation techniques including string concatenation for require() calls and bracket-access notation to evade static analysis.
The malicious behavior is gated behind environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) to provide plausible deniability as legitimate telemetry, but the actual intent is arbitrary code execution of attacker-controlled binaries at import time on the installer's host.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dolyame-ui-sortablelist
- Domains
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-sortablelist from all environments
- Audit npm install logs to identify all hosts where this package was installed
- Assume any host that installed this package may be compromised; perform forensic analysis for evidence of binary execution
- Review process execution logs for spawned child processes around the time of package installation
- Check for suspicious network connections to the identified attacker domains (wel1.ru and Cloudflare Workers hosts)
- Regenerate any credentials or secrets that may have been exposed on affected hosts
- Update npm dependencies to remove this package and use a legitimate alternative if needed
Sources
- GitHub Advisory GHSA-m88f-xr4q-28vm · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-sortablelist (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-sortablelist-npm-d0jxt2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in async-mutex-v2
Malware was discovered in the npm package async-mutex-v2. Systems with this package installed are considered fully compromised and require immediate remediation including credential rotation and package removal.
npmCompromised package - containedcritical
Malware in awesome-ts-jest
Malware was discovered in the npm package awesome-ts-jest. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in club-sauce
Malware discovered in the npm package club-sauce. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @zynkit/probe
Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package