MalwarePublished 5 Aug 2026

dolyame-ui-swiper (npm) · Malicious Code

Affects dolyame-ui-swiperSource GCVE Database

Malicious package : remove dolyame-ui-swiper and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 19:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13188

What to do

Remove dolyame-ui-swiper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-ui-swiper	Affected =35.7.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-ui-swiper version 35.7.7 contains malicious code that executes arbitrary remote code on the host system upon installation or require(). It downloads and runs an opaque native binary from obfuscated Cloudflare Workers subdomains and a fallback domain, disguises the binary with a hidden filename, sets executable permissions, and spawns it detached. This behavior is unrelated to the package's advertised UI functionality and occurs without verification or pinning of the downloaded binary.

Impact

Installation or requiring of dolyame-ui-swiper version 35.7.7 results in arbitrary remote code execution on the host system with the privileges of the installing user. This can lead to full compromise of the affected system, unauthorized access, data theft, or further malicious activity. The malicious binary is fetched from anonymous and unverified sources, increasing risk and preventing trust validation.

Defensive guidance

Users should immediately avoid installing or requiring dolyame-ui-swiper version 35.7.7. Remove the package if already installed and scan affected systems for the presence of the malicious binary under temporary directories. Monitor for suspicious child processes spawned by npm or node. Check vendor advisories or trusted security sources for updates or fixes. Until a fix is available, do not use this package version.

Summary

The dolyame-ui-swiper npm package version 35.7.7 includes a malicious init() routine in its _bridge.js entry point that triggers on require(). This routine selects an OS-specific path and downloads a native binary from multiple obfuscated Cloudflare Workers subdomains and a DNS TXT chunked-base64 fallback domain. The binary is saved under temporary directories with disguised filenames, permissioned as executable, and executed detached via shell commands. The hostnames and process identifiers are constructed at runtime to evade static detection. The downloaded binary is unrelated to the package's stated UI component purpose and is executed with the privileges of the installing process, enabling arbitrary remote code execution on the installer's host.

References

npmjs.com/package/dolyame-ui-swiper/v/35.7.7 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:15 UTC

Technical details

References

Community reviews