Malicious code in dolyame-ui-noindex (npm)
The npm package dolyame-ui-noindex version 35.8.1 is a malicious package that, upon being required, downloads and executes an unsigned platform-specific binary from suspicious remote hosts. The binary is saved in temporary directories under disguised filenames and executed detached from the parent process. The package uses obfuscation techniques and fallback DNS-TXT channels to retrieve payloads if HTTPS is blocked. Despite its name suggesting a legitimate UI library, it contains no UI functionality and solely performs this malicious code execution.
AI Analysis
Technical Summary
The dolyame-ui-noindex npm package (version 35.8.1) contains malicious code that triggers on import. It loads a platform-specific payload (for Linux x64/arm64, macOS, and Windows) by downloading an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru domains, which are reconstructed from split string arrays to evade detection. The binary is written to temporary directories with disguised names, permissioned to be executable, and then spawned detached via shell commands. If HTTPS is blocked, a DNS-TXT fallback channel reassembles base64-encoded payload chunks from numbered subdomains of dl.wel1.ru domains. This drop-and-execute routine is duplicated in telemetry.js with obfuscated child_process calls. The package name mimics a legitimate UI library but contains no UI code, only this malicious payload delivery and execution.
Potential Impact
This package enables remote code execution on any system that installs and requires it, potentially allowing attackers to run arbitrary unsigned binaries with the privileges of the user running the Node.js process. The obfuscation and fallback DNS channel increase the difficulty of detection and blocking. There is no indication of active exploitation in the wild yet.
Mitigation Recommendations
No official patch or remediation is currently available. Users and organizations should immediately remove this package version (35.8.1) from their projects and dependency trees. Avoid installing or using the dolyame-ui-noindex package entirely. Employ supply chain security measures such as verifying package authenticity and using trusted sources. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in dolyame-ui-noindex (npm)
Description
The npm package dolyame-ui-noindex version 35.8.1 is a malicious package that, upon being required, downloads and executes an unsigned platform-specific binary from suspicious remote hosts. The binary is saved in temporary directories under disguised filenames and executed detached from the parent process. The package uses obfuscation techniques and fallback DNS-TXT channels to retrieve payloads if HTTPS is blocked. Despite its name suggesting a legitimate UI library, it contains no UI functionality and solely performs this malicious code execution.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dolyame-ui-noindex npm package (version 35.8.1) contains malicious code that triggers on import. It loads a platform-specific payload (for Linux x64/arm64, macOS, and Windows) by downloading an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru domains, which are reconstructed from split string arrays to evade detection. The binary is written to temporary directories with disguised names, permissioned to be executable, and then spawned detached via shell commands. If HTTPS is blocked, a DNS-TXT fallback channel reassembles base64-encoded payload chunks from numbered subdomains of dl.wel1.ru domains. This drop-and-execute routine is duplicated in telemetry.js with obfuscated child_process calls. The package name mimics a legitimate UI library but contains no UI code, only this malicious payload delivery and execution.
Potential Impact
This package enables remote code execution on any system that installs and requires it, potentially allowing attackers to run arbitrary unsigned binaries with the privileges of the user running the Node.js process. The obfuscation and fallback DNS channel increase the difficulty of detection and blocking. There is no indication of active exploitation in the wild yet.
Mitigation Recommendations
No official patch or remediation is currently available. Users and organizations should immediately remove this package version (35.8.1) from their projects and dependency trees. Avoid installing or using the dolyame-ui-noindex package entirely. Employ supply chain security measures such as verifying package authenticity and using trusted sources. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13590
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f711bf8831d53984fb93
Added to database: 08/07/2026, 15:17:37 UTC
Last enriched: 08/07/2026, 15:42:56 UTC
Last updated: 08/07/2026, 15:42:56 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.