MalwarePublished 5 Aug 2026

dolyame-ui-react-version-switch (npm) · Malicious Code

Affects dolyame-ui-react-version-switchSource GCVE Database

Malicious package : remove dolyame-ui-react-version-switch and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 19:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13179

What to do

Remove dolyame-ui-react-version-switch from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-react-version-switch	Affected =35.6.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-react-version-switch version 35.6.1 contains malicious code that downloads and executes platform-specific binaries from obfuscated external hosts. The package pretends to be a React UI helper but its main functionality is to fetch and run potentially harmful executables without integrity verification. The downloaded files are saved to temporary directories with disguised names, given executable permissions on POSIX systems, and executed detached from the main process.

Impact

This malicious package can lead to arbitrary code execution on the host system by downloading and running unverified executables. This poses a significant risk of system compromise, data theft, or further malware installation. Because the payload is fetched from external, obfuscated sources and executed without integrity checks, it can evade detection and deliver a wide range of malicious payloads.

Defensive guidance

The best mitigation is to avoid using the dolyame-ui-react-version-switch package version 35.6.1 and remove it from any environments where it is installed. Use trusted sources and verify package integrity before installation. Monitor for and block network connections to the identified suspicious domains if possible.

Summary

The dolyame-ui-react-version-switch npm package version 35.6.1 includes a malicious dropper in its index.js file. Instead of providing legitimate UI functionality, it unconditionally requires a _vendor.js module that dynamically constructs obfuscated URLs to fetch binary payloads over HTTPS from multiple suspicious hosts. It uses DNS-TXT record fallback to evade HTTPS filtering. The fetched binaries are saved to temporary locations with disguised filenames, made executable on POSIX systems, and executed via shell commands without any hash or integrity verification despite a misleading comment claiming SHA-256 checks. The package's advertised React UI interface is a no-op stub, serving as a cover for the malicious behavior.

References

npmjs.com/package/dolyame-ui-react-version-switch/v/35.6.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:29 UTC

Technical details

References

Community reviews