Threats Tagged 'mal-2026-13512'

The npm package dolyame-ui-tabsblock version 35.8.1 contains malicious code that, upon being imported, dynamically reconstructs hostnames to fetch and execute attacker-controlled native binaries. These binaries are downloaded from Cloudflare Workers subdomains or, as a fallback, retrieved via DNS TXT record queries from specific domains. The payload is saved to temporary directories with randomized filenames, made executable, and launched detached from the main process. The package uses string obfuscation techniques to evade static detection and masquerades as a legitimate SDK. This behavior results in arbitrary native code execution on the host system whenever the package is imported.