Malicious code in dolyame-ui-controlgroup (npm)
The npm package dolyame-ui-controlgroup version 35.8.1 contains malicious code that downloads and executes a native binary from obfuscated and suspicious external hosts. This binary is written to a temporary file with a hidden name, given executable permissions, and executed detached from the main process. The package uses runtime string assembly and dynamic property access to evade detection. The malicious payload activates even if certain require calls are removed, indicating deliberate evasion techniques.
AI Analysis
Technical Summary
The dolyame-ui-controlgroup npm package version 35.8.1 includes a malicious dropper that, upon require(), selects a per-OS/architecture URL from obfuscated hostnames and downloads a native binary. This binary is saved to a temporary file with a randomized hidden name resembling legitimate diagnostic tools, chmodded to executable, and spawned detached via shell commands. The main module duplicates this dropper using a base64-decoded buffer, ensuring execution even if the initial require is bypassed. Hostnames and dangerous API calls such as 'child_process' and 'chmodSync' are dynamically constructed at runtime to evade static detection. The download endpoints and filenames are unrelated to the package's advertised functionality, indicating deliberate malicious intent.
Potential Impact
If executed, the malicious code can run arbitrary native binaries on the host system with the permissions of the user running the Node.js process. This can lead to unauthorized code execution, potential system compromise, and persistence. The obfuscation and evasion techniques increase the difficulty of detection and removal.
Mitigation Recommendations
No official patch or remediation is currently documented for this package version. Users should avoid installing or using dolyame-ui-controlgroup version 35.8.1. Remove any existing installations of this package from projects and dependency trees. Use trusted sources and verify package integrity before installation. Monitor for updates from the package maintainer or npm advisories for any official fixes.
Malicious code in dolyame-ui-controlgroup (npm)
Description
The npm package dolyame-ui-controlgroup version 35.8.1 contains malicious code that downloads and executes a native binary from obfuscated and suspicious external hosts. This binary is written to a temporary file with a hidden name, given executable permissions, and executed detached from the main process. The package uses runtime string assembly and dynamic property access to evade detection. The malicious payload activates even if certain require calls are removed, indicating deliberate evasion techniques.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dolyame-ui-controlgroup npm package version 35.8.1 includes a malicious dropper that, upon require(), selects a per-OS/architecture URL from obfuscated hostnames and downloads a native binary. This binary is saved to a temporary file with a randomized hidden name resembling legitimate diagnostic tools, chmodded to executable, and spawned detached via shell commands. The main module duplicates this dropper using a base64-decoded buffer, ensuring execution even if the initial require is bypassed. Hostnames and dangerous API calls such as 'child_process' and 'chmodSync' are dynamically constructed at runtime to evade static detection. The download endpoints and filenames are unrelated to the package's advertised functionality, indicating deliberate malicious intent.
Potential Impact
If executed, the malicious code can run arbitrary native binaries on the host system with the permissions of the user running the Node.js process. This can lead to unauthorized code execution, potential system compromise, and persistence. The obfuscation and evasion techniques increase the difficulty of detection and removal.
Mitigation Recommendations
No official patch or remediation is currently documented for this package version. Users should avoid installing or using dolyame-ui-controlgroup version 35.8.1. Remove any existing installations of this package from projects and dependency trees. Use trusted sources and verify package integrity before installation. Monitor for updates from the package maintainer or npm advisories for any official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13563
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f70fbf8831d53984fa04
Added to database: 08/07/2026, 15:17:35 UTC
Last enriched: 08/07/2026, 15:32:43 UTC
Last updated: 08/07/2026, 15:32:43 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.