MalwarePublished 5 Aug 2026

dolyame-ui-skeleton (npm) · Malicious Code

Affects dolyame-ui-skeletonSource GCVE Database

Malicious package : remove dolyame-ui-skeleton and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 19:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13183

What to do

Remove dolyame-ui-skeleton from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-skeleton	Affected =35.2.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-skeleton, advertised as a UI components library, contains malicious code that downloads and executes platform-specific native binaries at load time. It uses obfuscated Cloudflare Workers hosts and a covert DNS TXT query channel to fetch payloads, evading static analysis and HTTPS egress filtering. This behavior is unusual and unjustified for a UI component package, indicating malicious intent.

Impact

Users who install or run the affected version of dolyame-ui-skeleton (35.2.5) risk executing unauthorized native binaries on their systems, potentially leading to system compromise, data theft, or further malware deployment. The covert delivery mechanisms and obfuscation techniques make detection and blocking difficult, increasing the risk of undetected malicious activity.

Defensive guidance

Users should immediately remove the affected version (=35.2.5) of dolyame-ui-skeleton from their projects and avoid installing this package. Employ strict package source verification and scanning to prevent use of this malicious package. Monitor for updates from the package maintainer or npm advisory for any official fixes or removals.

Summary

The dolyame-ui-skeleton npm package (version 35.2.5) includes a malicious load-time binary dropper. Its index.js requires a _vendor.js module that downloads a platform-specific binary from obfuscated Cloudflare Workers domains, writes it to a hidden cache path, sets executable permissions, and spawns it detached via shell commands. To evade detection, the package reconstructs destination hostnames at runtime and uses DNS TXT queries to retrieve base64-encoded binary chunks from multiple domains as a fallback mechanism, bypassing HTTPS egress filtering. The dropped binaries use filenames mimicking legitimate system or analytics files. There is no legitimate reason for a UI component package to perform these actions, confirming the package's malicious nature.

References

npmjs.com/package/dolyame-ui-skeleton/v/35.2.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:16 UTC

Technical details

References

Community reviews