MalwarePublished 5 Aug 2026

dolyame-ui-list (npm) · Malicious Code

Affects dolyame-ui-listSource GCVE Database

Malicious package : remove dolyame-ui-list and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 19:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13165

What to do

Remove dolyame-ui-list from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-list	Affected =35.2.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-list version 35.2.6 contains malicious code that downloads and executes a platform-specific executable from untrusted Cloudflare Workers hosts and a DNS TXT fallback domain. The executable is saved to temporary directories with names mimicking legitimate diagnostic tools, given executable permissions, and run detached from the parent process. The package obfuscates hostnames and API calls and includes a secondary loader under lib/telemetry.js with identical behavior. This package impersonates a legitimate Russian BNPL vendor's UI ecosystem but exhibits no legitimate functionality.

Impact

The malicious package can download and execute arbitrary platform-specific binaries from attacker-controlled infrastructure without integrity verification, leading to potential remote code execution on affected systems. The use of obfuscation and mimicry of legitimate telemetry SDKs may evade detection. This compromises the security of any environment that installs and runs this package version.

Defensive guidance

Users should immediately avoid using version 35.2.6 of dolyame-ui-list. Remove the package from all environments and replace it with verified, trusted dependencies. Monitor for any signs of compromise related to this package.

Summary

The dolyame-ui-list npm package (version 35.2.6) includes malicious code that, upon require(), loads a script (_vendor.js) which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers domains (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) and uses a DNS TXT fallback under *.dl.wel1.ru. The code obfuscates destination hostnames and API calls using array fragment joins and dynamic member access. The downloaded executable is saved to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, given executable permissions (chmod 0755), and executed detached via shell commands. Environment variables related to telemetry are checked to disguise the behavior as telemetry SDK activity. A second copy of the dropper is embedded as lib/telemetry.js, providing an alternate execution path. The package name mimics a legitimate vendor but the behavior is inconsistent with any legitimate use, indicating malicious intent.

References

npmjs.com/package/dolyame-ui-list/v/35.2.6 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:29 UTC

Technical details

References

Community reviews