Threats Tagged 'mal-2026-13588'

The npm package dolyame-ui-mediainfohoc contains malicious code that downloads and executes opaque binaries from hardcoded remote hosts. It writes these binaries to temporary directories, sets executable permissions, and spawns them detached from the main process. The package uses obfuscation techniques to evade detection and disguises this behavior as telemetry. Two independent backdoor droppers are embedded, one in _platform.js and another in lib/telemetry.js, both capable of executing the payload upon requiring the package. The package name mimics a legitimate UI helper but is in fact a malicious package.