MalwarePublished 5 Aug 2026

dolyame-ui-popover (npm) · Malicious Code

Affects dolyame-ui-popoverSource GCVE Database

Malicious package : remove dolyame-ui-popover and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 19:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13174

What to do

Remove dolyame-ui-popover from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-popover	Affected =35.8.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-popover version 35.8.7 contains malicious code that, upon being required, downloads and executes attacker-controlled native binaries specific to the host OS and architecture. These binaries are fetched from obfuscated Cloudflare Workers endpoints and fallback DNS TXT records, saved under deceptive filenames in temporary directories, given execute permissions, and launched detached from the main process. The package masquerades as a payments UI library but its sole runtime effect is to execute this malicious payload. No official patch or remediation guidance is currently provided.

Impact

The malicious package enables remote code execution on the host machine by downloading and running attacker-controlled native binaries. This can lead to full compromise of the affected system, unauthorized persistence, and potential further malicious activity. Since the code executes with the privileges of the user running the npm package, it poses a significant security risk.

Defensive guidance

Users should immediately remove the affected version (=35.8.7) of dolyame-ui-popover from their projects and avoid installing or requiring this package. Verify dependencies to ensure this package is not included transitively. Monitor for any unusual processes spawned from temporary directories. Check vendor advisories or trusted security sources for updates on remediation or replacement versions.

Summary

The dolyame-ui-popover npm package version 35.8.7 includes a malicious payload that activates on require(). It loads an internal script (_ext.js) that dynamically constructs obfuscated URLs to download native binaries from Cloudflare Workers hosts and a DNS TXT fallback under *.dl.wel1.ru. The downloaded binaries are saved to temporary directories with misleading names, permissions are set to executable (0755), and they are executed detached from the main process using shell commands. The package also contains a telemetry.js script that duplicates these drop and execute functions. This behavior effectively allows remote code execution of attacker-controlled native code on the host system. The package name is deceptive, imitating a UI library for payments, but it serves only to deliver and run malicious code.

References

npmjs.com/package/dolyame-ui-popover/v/35.8.7 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:28 UTC

Technical details

References

Community reviews