MalwarePublished 5 Aug 2026Updated 20 Aug 2026

dolyame-ui-form (npm) · Malicious Code

Affects dolyame-ui-formSource GCVE Database

Malicious package : remove dolyame-ui-form and rotate any secrets on hosts that installed it.

Data as of 20 Aug 2026, 16:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12367

What to do

Remove dolyame-ui-form from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-form	Affected =20.1.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-form version 20.1.7 contains malicious code that downloads and executes payloads from hardcoded external hosts. It disguises the payload as .NET diagnostic or cache files and executes them on the host system, potentially giving full control to an attacker. The package name mimics a legitimate brand to evade suspicion, but exports only an empty stub. Systems with this package installed should be considered fully compromised.

Impact

Any system with this package installed is likely fully compromised, as the package downloads and executes arbitrary code from attacker-controlled servers. This can lead to complete loss of confidentiality, integrity, and availability. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment. Removing the package alone may not remove all malicious components or backdoors installed by the payload.

Defensive guidance

Remove the dolyame-ui-form package version 20.1.7 immediately. Consider the affected system fully compromised and perform a thorough incident response, including secret and key rotation from a separate trusted system. Monitor for any suspicious activity related to this package and avoid installing packages from untrusted sources.

Summary

The dolyame-ui-form npm package (version 20.1.7) acts as a dropper. Upon requiring the package, it loads a _bootstrap.js script that selects a payload based on OS and architecture. This payload is downloaded from several hardcoded Cloudflare Workers hosts or via DNS TXT-record fallback domains. The downloaded bytes are saved to a randomly named file in temporary directories, disguised as .NET diagnostic or cache files, set executable, and launched detached via shell commands. The package exports only an empty stub and declares no dependencies, using the UI form claim as a cover story. The runtime reconstructs destination hostnames from substrings to evade static detection. This behavior indicates full system compromise upon installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2026, 16:58 UTC

Technical details

References

Community reviews