{"answers":{"affected":"1 open source package ship an affected version, including dolyame-ui-inputcolor.","exploited":"There is no known exploitation of MAL-2026-13507 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13507 is a malicious package in dolyame-ui-inputcolor, published on 7 Aug 2026."},"fix_prompt":"MAL-2026-13507 is a malicious package: dolyame-ui-inputcolor (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13507/ (Markdown: https://insights.sbomify.com/MAL-2026-13507/index.md)","id":"MAL-2026-13507","markdown":"https://insights.sbomify.com/MAL-2026-13507/index.md","name":"MAL-2026-13507","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"index.js unconditionally requires./_loader on load. _loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners (e.g., [\"oob-w\",\"orker\",\".cf\",\"101-adf.workers.\",\"de\",\"v\"].join(\"\")), selects an OS-specific endpoint, and fetches a binary payload over HTTPS from one of four oob-worker.cf10[0-3]-*.workers.dev hosts. On HTTPS failure, it falls back to a DNS-TXT covert channel: it queries chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-concatenates the chunks, and reconstitutes the payload buffer. The bytes are written to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. Module names, API names, and hostnames are reconstructed via string concatenation and dynamic property access (require(\"child_\" + \"process\"), fs[\"chmod\" + \"Sync\"], os[\"host\" + \"name\"]) to defeat plain-text matching. The dropper fires on every require() of this package, granting the operator of those hosts arbitrary code execution on any machine that installs or imports it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dolyame-ui-inputcolor (npm)","id":"MAL-2026-13507","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dolyame-ui-inputcolor","purl":"pkg:npm/dolyame-ui-inputcolor","source":"MAL-2026-13507"}],"products":null,"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13507/"}