MalwarePublished 5 Aug 2026

dolyame-ui-checkable (npm) · Malicious Code

Affects dolyame-ui-checkableSource GCVE Database

Malicious package : remove dolyame-ui-checkable and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 20:01 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13143

What to do

Remove dolyame-ui-checkable from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-checkable	Affected =35.4.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-checkable version 35.4.1 contains malicious code that executes automatically upon import. It downloads and executes platform-specific binaries from Cloudflare workers.dev mirrors or via a DNS TXT record covert channel, enabling execution of a dropper binary designed to bypass HTTPS egress filtering. The package disguises its malicious behavior under the guise of a UI utility, using obfuscation techniques and a secondary dropper embedded in telemetry code. No patch or remediation information is currently available.

Impact

Any project importing or requiring dolyame-ui-checkable version 35.4.1 risks automatic execution of malicious binaries that can run arbitrary code on the host system. The use of covert DNS tunneling and disguised filenames increases the likelihood of evading detection and network filtering, potentially leading to system compromise or persistence.

Defensive guidance

Until a fix or official advisory is available, avoid using or importing dolyame-ui-checkable version 35.4.1. Consider removing the package from existing projects and scanning for its presence in dependencies.

Summary

The dolyame-ui-checkable npm package version 35.4.1 includes a malicious dropper that triggers on any require or import of the package. The dropper reconstructs URLs for Cloudflare workers.dev mirrors to download platform-specific binaries over HTTPS, saving them to temporary directories with disguised filenames and executing them detached from the main process. If HTTPS delivery fails, it falls back to a DNS TXT record-based covert channel to retrieve and execute a base64-encoded binary, bypassing typical network egress filtering. Additionally, a second dropper is embedded in telemetry.js, mimicking a Sentry SDK but performing similar malicious binary download and execution. The combination of obfuscation, covert DNS tunneling, and automatic execution characterizes this package as a hostile installer.

References

npmjs.com/package/dolyame-ui-checkable/v/35.4.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 20:01 UTC

Technical details

References

Community reviews