Malicious code in dolyame-ui-tabsblock (npm)
The npm package dolyame-ui-tabsblock contained malicious code that downloads and executes arbitrary binaries from attacker-controlled infrastructure on package require. The package mimics a Russian BNPL brand while performing remote code execution via obfuscated payloads.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed the malicious dolyame-ui-tabsblock package
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-tabsblocknpm package containing malicious code
The npm package dolyame-ui-tabsblock was found to contain malicious code that executes on require. The package loads obfuscated modules (_compat and lib/telemetry) that reconstruct hostnames at runtime from string fragments to fetch platform-specific binaries from Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev).\n\nThe downloaded binaries are written to temporary directories (/tmp on Unix, Windows temp directory on Windows) under randomized filenames, made executable via chmod 755, and launched as detached processes. A time-gated flag in /tmp prevents re-execution within approximately six hours. If HTTPS delivery fails, the malware falls back to DNS TXT record queries against wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) to retrieve base64-encoded payloads.\n\nThe lib/telemetry.js module contains a parallel execution path disguised as a Sentry-compatible APM SDK. API names for child_process, chmod, and hostname functions are obfuscated using string splitting to evade static analysis. The package name itself mimics a legitimate Russian BNPL (buy-now-pay-later) brand, suggesting social engineering or typosquatting intent.\n\nThis represents a supply chain attack delivering remote code execution to any Node.js application that installed the malicious package.
Indicators of compromise
- Packages
- dolyame-ui-tabsblock
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf101-adf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-tabsblock from all projects
- Audit npm package.json and lock files for any version of dolyame-ui-tabsblock
- Review node_modules for the presence of this package
- Check system logs and /tmp directories for evidence of binary execution
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Monitor for suspicious outbound connections to oob-worker.*.workers.dev and wel1.ru domains
- Update to a clean version of any legitimate UI component library that was intended
- Consider running security scanning tools on affected systems to detect any dropped payloads
Sources
- GitHub Advisory GHSA-48hx-6pv6-rvc9 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-tabsblock (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-tabsblock-npm-0x15vf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package