Malicious code in dolyame-ui-stateutils (npm)
The npm package dolyame-ui-stateutils contained malicious code that downloads and executes platform-specific binaries from obfuscated Cloudflare Workers endpoints and DNS-based fallback channels on import. The package masqueraded as a monitoring/observability SDK but performed unauthorized code execution.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of the malicious package versions
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-stateutilsnpm package containing malicious code
The npm package dolyame-ui-stateutils was found to contain malicious code that executes on require()/import. The package's index.js loads _loader.js, which fetches opaque platform-specific binaries from three obfuscated Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT base64 fallback distribution mechanism using domains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.
The downloaded payload is written to /tmp or %TEMP% under filenames disguised as system tools (dotnet_diag_.exe, .cache_), made executable (chmod 0755 on POSIX), and executed via /bin/sh -c or cmd.exe. Both the Workers hostnames and DNS resolver domains are assembled at runtime using fragmented string arrays to evade static analysis detection.
The package.json falsely describes the package as a 'Monitoring and observability SDK' and includes environment variable gates (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK), but the package name is unrelated to any legitimate monitoring product. A rate-limiting cache at /tmp/.analytics_state throttles re-fetches of the malicious payload.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-stateutils
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove dolyame-ui-stateutils from all projects and dependencies
- Audit package.json and lock files for any versions of dolyame-ui-stateutils
- Review npm audit logs and dependency trees for this package
- If the package was installed, inspect /tmp and %TEMP% directories for suspicious files matching dotnet_diag_* or .cache_* patterns
- Monitor systems that may have executed this package for unauthorized process execution and network connections to the identified Cloudflare Workers and DNS domains
- Update to a clean version of any legitimate monitoring/observability SDK if needed
- Consider using npm package scanning tools to detect similar malicious packages in your supply chain
Sources
- GitHub Advisory GHSA-fvh5-mpq2-8g44 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-stateutils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-stateutils-npm-1ezpuw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in cloud-agen-bot
The npm package cloud-agen-bot contains malware that grants full control of affected systems to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in awesome-ts-jest
Malware was discovered in the npm package awesome-ts-jest. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in userbotjs-jun
The npm package userbotjs-jun was found to contain malware, potentially providing full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in autoai
The npm package autoai was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately, and the package should be removed.
npmCompromised package