{"answers":{"affected":"1 open source package ship an affected version, including dolyame-ui-button.","exploited":"There is no known exploitation of MAL-2026-13139 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13139 is a malicious package in dolyame-ui-button, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-13139 is a malicious package: dolyame-ui-button (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13139/ (Markdown: https://insights.sbomify.com/MAL-2026-13139/index.md)","id":"MAL-2026-13139","markdown":"https://insights.sbomify.com/MAL-2026-13139/index.md","name":"MAL-2026-13139","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package advertises itself as a React UI button but its index.js unconditionally requires _bootstrap.js on module load. _bootstrap.js downloads a platform-specific binary from string-array-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev and siblings), writes it to /var/tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If the HTTPS fetch fails, the bootstrap falls back to a DNS-over-TXT covert channel against *.dl.wel1.ru: it queries a chunk count from c.\u003cdomain\u003e, batches per-chunk TXT queries at 0.\u003cdomain\u003e..N.\u003cdomain\u003e, base64-concatenates the responses, and writes and executes the resulting binary. C2 hostnames are reassembled at runtime from split-and-join arrays, and cover-story comments (\"Shuffle endpoints to distribute load\", \"SHA-256 integrity check\") accompany code that performs no integrity verification. The behavior is unrelated to any UI component functionality and grants the publisher arbitrary code execution on any host that imports the package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dolyame-ui-button (npm)","id":"MAL-2026-13139","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dolyame-ui-button","purl":"pkg:npm/dolyame-ui-button","source":"MAL-2026-13139"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13139/"}