Malicious code in dolyame-ui-tabslayout (npm)
The npm package dolyame-ui-tabslayout contained malicious code that executes on require, downloading and executing OS-specific binaries from obfuscated Cloudflare Workers URLs or DNS-TXT fallback domains. The package was disguised as build/deployment tooling and wrapped the dropper inside a fake Sentry-style analytics SDK.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed and required the dolyame-ui-tabslayout package; the malicious code executes on require, fetching and executing OS-specific binaries.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-ui-tabslayoutnpm package containing dropper logic in index.js, lib/telemetry.js, and _polyfill.js
The npm package dolyame-ui-tabslayout was found to contain malicious dropper code that activates when the package is required. The malicious logic is embedded in index.js, lib/telemetry.js, and polyfill.js.\n\nThe dropper selects an OS-specific execution path and fetches a binary payload from one of three obfuscated Cloudflare Workers URLs: oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, or oob-worker.cf100-416.workers.dev. If those fail, it falls back to base64-encoded DNS-TXT queries from *.dl.wel1.ru. The payload is written to a temporary path using cover names such as dotnet_diag.exe or .cache_, given execute permissions (0755), and spawned detached via /bin/sh -c (Unix) or cmd (Windows).\n\nTo evade static analysis, the malicious code assembles destination hostnames and dangerous API references at runtime using string-splitting concatenation (e.g., ['oob-worker.cf102-baf','.worke','rs.dev'].join(''), require('child_' + 'process'), fs['chmod'+'Sync']). The package masquerades as build/deployment tooling and wraps the dropper inside a fake Sentry-style analytics SDK to appear legitimate.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- dolyame-ui-tabslayout
- Domains
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- dl.wel1.ru
Remediation
- Immediately uninstall dolyame-ui-tabslayout from all systems and projects
- Audit npm install logs and dependency trees to identify all systems that may have installed this package
- Review system logs and process execution history on affected machines for signs of binary downloads and execution from the identified C2 domains
- Block outbound connections to oob-worker.cf*.workers.dev and *.dl.wel1.ru at the network level
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Consider the affected systems potentially compromised and perform forensic analysis or reimaging as appropriate
Sources
- GitHub Advisory GHSA-h8wx-r33x-9pxx · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-ui-tabslayout (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-ui-tabslayout-npm-1ufh4a
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package