Threats Tagged 'mal-2026-13554'

The npm package dolyame-ui-buttonstore version 35.8.1 is identified as a malicious dropper. It loads a setup script that dynamically constructs URLs to fetch and execute opaque binary payloads from multiple evasive hosts. The payload is saved to hidden temporary files with execution permissions and launched detached from the parent process. If HTTPS fetching fails, a DNS TXT record fallback mechanism reconstructs a base64 payload from subdomains. The package masquerades as a legitimate TypeScript definitions library but contains only the dropper and a telemetry script. The author field is empty, and the runtime behavior indicates intentional evasion techniques.