{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "_adapter.js",
              "sha256": "a71bb282bb6f6dbb48943701be6fea3c81ac1811edd587926676e86ca41ebc96",
              "tlsh": "0da1a65926fa30180793b2e4841f4826719af69333c4e9d4fb4c66945fd663883b2afc"
            },
            {
              "path": "lib/telemetry.js",
              "sha256": "280ab5ad96a8282e8b5480c5a2c0638c02eafc9631fe6190ea1c2811a052b068",
              "tlsh": "fd733f4966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"
            }
          ],
          "package_integrity": [
            {
              "filename": "dolyame-ui-deprecatepropshoc-35.8.1.tgz",
              "hashes": {
                "sha1": "bcf586f1fc78cb11ef0b7b43e4eb37f1bce425bd",
                "sha512_sri": "sha512-OZEO8YeYkoOTEwTtIPNDT8mRPMd02fZN2SHbQw0+YjWRdqrmN6hl5SncyFV/x41HzugOZyN9eh8JMItXT9AACw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "dolyame-ui-deprecatepropshoc"
      },
      "versions": [
        "35.8.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017037",
        "import_time": "2026-08-07T12:51:23.229826617Z",
        "modified_time": "2026-08-07T12:34:46Z",
        "sha256": "e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226",
        "source": "amazon-inspector",
        "versions": [
          "35.8.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226)\nOn require(), dolyame-ui-deprecatepropshoc@35.8.1 side-effect-loads _adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments ([\u0027oob-worker.cf101-adf.\u0027,\u0027wor\u0027,\u0027kers.dev\u0027].join(\u0027\u0027)) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, fetch a platform-specific opaque binary (/pkg/package, /pkg/loader_mac, /pkg/package.exe), write it to /var/tmp/.cache_\u003cuid\u003e or %TEMP%\\dotnet_diag_\u003cuid\u003e.exe, apply mode 0755 via fs[\u0027chmod\u0027+\u0027Sync\u0027], and spawn it detached through /bin/sh -c or cmd.exe /c start /b. child_process is loaded via require(\u0027child_\u0027+\u0027process\u0027) to evade static matching. There is no version pin, hash, or signature verification on the fetched executable. The dropper is duplicated inside lib/telemetry.js \u2014 the module referenced by index.js\u0027s module.exports \u2014 so the payload deploys even if _adapter.js is removed. The \u0027telemetry\u0027/\u0027analytics_state\u0027/\u0027dotnet_diag_\u0027 naming is a cover story; the behavior is remote-code execution on the installer at require() time.\n",
  "id": "MAL-2026-13566",
  "modified": "2026-08-07T12:34:46Z",
  "published": "2026-08-07T12:34:46Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/dolyame-ui-deprecatepropshoc/v/35.8.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in dolyame-ui-deprecatepropshoc (npm)"
}