MalwarePublished 5 Aug 2026

dolyame-ui-stepper (npm) · Malicious Code

Affects dolyame-ui-stepperSource GCVE Database

Malicious package : remove dolyame-ui-stepper and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 19:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13185

What to do

Remove dolyame-ui-stepper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-stepper	Affected =35.7.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-stepper version 35.7.5 contains malicious code that executes automatically upon import. It downloads a native binary from obfuscated external hosts, saves it under a disguised filename resembling a Microsoft diagnostic tool, sets executable permissions, and runs it detached without user interaction. A secondary dropper with similar behavior is present but not currently reachable. This behavior poses a risk of unauthorized code execution on the host system.

Impact

This malicious package enables automatic execution of downloaded native binaries on the host system whenever the package is imported, potentially leading to unauthorized code execution, persistence, and further compromise. The disguised filenames and obfuscated hostnames indicate an attempt to evade detection. There is no indication of known exploits in the wild yet, but the risk of compromise is significant due to the automatic and silent execution.

Defensive guidance

Users should immediately avoid using version 35.7.5 of dolyame-ui-stepper. Remove the package from all projects and replace it with a trusted alternative. Monitor for any unexpected processes or files resembling the described binaries. Since this is a malicious package, standard patching does not apply; remediation involves removal and avoidance.

Summary

The dolyame-ui-stepper npm package version 35.7.5 includes malicious functionality triggered on require(). Its index.js loads a shim.js that reconstructs obfuscated hostnames and fetches a platform-specific native binary via HTTPS. The binary is saved to a temporary location with a disguised name (e.g., dotnet_diag_<hex>.exe on Windows), permissions set to executable, and then spawned detached using shell commands. Additionally, a duplicate dropper is present in lib/telemetry.js under an 'Analytics SDK' guise but is not currently invoked. The external hosts used for fetching are obfuscated through string splitting and include fallback DNS-TXT base64 retrieval methods. This results in automatic remote code execution without user consent.

References

npmjs.com/package/dolyame-ui-stepper/v/35.7.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:15 UTC

Technical details

References

Community reviews