Malicious code in dolyame-ui-navigation (npm)
The npm package dolyame-ui-navigation (version 35.7.3) contains malicious code that executes an attacker-controlled binary upon being imported. The package fetches a platform-specific executable from hardcoded Cloudflare Workers URLs and falls back to DNS-TXT resolution from suspicious domains. The downloaded payload is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. This behavior occurs immediately on require() of the package, causing automatic execution of malicious code on the host system.
AI Analysis
Technical Summary
The dolyame-ui-navigation npm package (version 35.7.3) masquerades as a UI navigation toolkit but contains embedded malicious functionality. Its main entry point requires a compatibility script that downloads a platform-specific executable from obfuscated Cloudflare Workers hosts and fallback DNS-TXT domains. The payload is saved under disguised names in temporary directories, permissions are set to executable, and it is spawned detached using shell commands on POSIX or Windows systems. Additional telemetry code dynamically reconstructs child process and filesystem calls to evade static analysis. The malicious binary runs immediately when the package is imported, leading to automatic execution of attacker-controlled code on the host.
Potential Impact
Any user or system that installs and imports the dolyame-ui-navigation package version 35.7.3 will automatically execute a malicious binary controlled by an attacker. This can lead to unauthorized code execution on the host system, potentially compromising system integrity, confidentiality, and availability. The malware uses obfuscation and dynamic code loading to evade detection and persist state blending with system files.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package version. Users should immediately remove the dolyame-ui-navigation package version 35.7.3 from their projects and dependency trees. Avoid installing or importing this package. Monitor for any unexpected processes spawned from temporary directories and investigate systems where this package was used. Check vendor or repository advisories for updates or official guidance.
Malicious code in dolyame-ui-navigation (npm)
Description
The npm package dolyame-ui-navigation (version 35.7.3) contains malicious code that executes an attacker-controlled binary upon being imported. The package fetches a platform-specific executable from hardcoded Cloudflare Workers URLs and falls back to DNS-TXT resolution from suspicious domains. The downloaded payload is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. This behavior occurs immediately on require() of the package, causing automatic execution of malicious code on the host system.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dolyame-ui-navigation npm package (version 35.7.3) masquerades as a UI navigation toolkit but contains embedded malicious functionality. Its main entry point requires a compatibility script that downloads a platform-specific executable from obfuscated Cloudflare Workers hosts and fallback DNS-TXT domains. The payload is saved under disguised names in temporary directories, permissions are set to executable, and it is spawned detached using shell commands on POSIX or Windows systems. Additional telemetry code dynamically reconstructs child process and filesystem calls to evade static analysis. The malicious binary runs immediately when the package is imported, leading to automatic execution of attacker-controlled code on the host.
Potential Impact
Any user or system that installs and imports the dolyame-ui-navigation package version 35.7.3 will automatically execute a malicious binary controlled by an attacker. This can lead to unauthorized code execution on the host system, potentially compromising system integrity, confidentiality, and availability. The malware uses obfuscation and dynamic code loading to evade detection and persist state blending with system files.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package version. Users should immediately remove the dolyame-ui-navigation package version 35.7.3 from their projects and dependency trees. Avoid installing or importing this package. Monitor for any unexpected processes spawned from temporary directories and investigate systems where this package was used. Check vendor or repository advisories for updates or official guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13170
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738534bf8831d5394f0a1e
Added to database: 08/05/2026, 18:47:16 UTC
Last enriched: 08/05/2026, 19:30:23 UTC
Last updated: 08/05/2026, 19:30:23 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.