{"answers":{"affected":"1 open source package ship an affected version, including dolyame-ui-list.","exploited":"There is no known exploitation of MAL-2026-13165 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13165 is a malicious package in dolyame-ui-list, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-13165 is a malicious package: dolyame-ui-list (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13165/ (Markdown: https://insights.sbomify.com/MAL-2026-13165/index.md)","id":"MAL-2026-13165","markdown":"https://insights.sbomify.com/MAL-2026-13165/index.md","name":"MAL-2026-13165","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require() of dolyame-ui-list, index.js loads _vendor.js which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS TXT fallback discovery channel under *.dl.wel1.ru. Destination hostnames and API names are obfuscated via array-fragment join(\"\") and dynamic member access (e.g. require(\"child_\" + \"process\"), fs[\"chmod\" + \"Sync\"]). The fetched bytes are written to /var/tmp/.cache_\u003chex\u003e on Linux/macOS or %TEMP%\\dotnet_diag_\u003chex\u003e.exe on Windows (a lookalike name imitating a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No version pin, no hash or signature verification, and the hosts are not the publisher's infrastructure. Environment variables DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are checked as a cover story consistent with a telemetry SDK. A second full copy of the same dropper ships as lib/telemetry.js (81 KB) with identical primitives, providing an alternate loader path. The package name resembles the Russian BNPL vendor Dolyame's UI ecosystem but the behavior matches no legitimate use.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dolyame-ui-list (npm)","id":"MAL-2026-13165","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dolyame-ui-list","purl":"pkg:npm/dolyame-ui-list","source":"MAL-2026-13165"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13165/"}