MalwarePublished 5 Aug 2026

dolyame-ui-carousel (npm) · Malicious Code

Affects dolyame-ui-carouselSource GCVE Database

Malicious package : remove dolyame-ui-carousel and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 20:02 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13141

What to do

Remove dolyame-ui-carousel from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-carousel	Affected =35.3.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-carousel version 35.3.3 contains malicious code that downloads and executes a native binary from anonymous Cloudflare Workers endpoints upon import. The package masquerades as a UI carousel component but performs unauthorized network activity to fetch and run a hidden executable in temporary directories, using obfuscated domain names and fallback covert channels. This behavior is unrelated to the package's declared functionality and indicates a supply chain compromise.

Impact

The malicious code enables remote code execution on any system importing the affected package version, potentially allowing attackers to execute arbitrary native binaries without user consent. This compromises system integrity and confidentiality. The covert download and execution mechanism bypasses normal package expectations and may evade detection by static analysis tools. No known exploits in the wild are reported at this time.

Defensive guidance

Users should immediately avoid using dolyame-ui-carousel version 35.3.3 and remove it from their environments. Consider replacing it with a trusted alternative or verifying package integrity before use. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals.

Summary

The dolyame-ui-carousel npm package version 35.3.3 includes a malicious shim.js script that dynamically selects a platform-specific payload path and downloads a native binary from obfuscated Cloudflare Workers hosts. It uses string-array joins to evade static detection and implements a DNS TXT chunked-base64 covert-channel fallback to additional domains. The downloaded binary is saved to disguised paths in /tmp or %TEMP%, given executable permissions, and executed detached from the main process. Execution is gated by a stamp file to prevent repeated runs. The package uses misleading identifiers such as _NODES, analytics_state, and DISABLE_TELEMETRY to conceal its drop-and-execute behavior. This activity is inconsistent with the package's stated purpose as a UI carousel component, indicating malicious intent.

References

npmjs.com/package/dolyame-ui-carousel/v/35.3.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 20:02 UTC

Technical details

References

Community reviews