{"answers":{"affected":"1 open source package ship an affected version, including dolyame-ui-collapseblock.","exploited":"There is no known exploitation of MAL-2026-13559 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13559 is a malicious package in dolyame-ui-collapseblock, published on 7 Aug 2026."},"fix_prompt":"MAL-2026-13559 is a malicious package: dolyame-ui-collapseblock (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13559/ (Markdown: https://insights.sbomify.com/MAL-2026-13559/index.md)","id":"MAL-2026-13559","markdown":"https://insights.sbomify.com/MAL-2026-13559/index.md","name":"MAL-2026-13559","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require(), _shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via array-join to evade static inspection. The payload is written to /tmp or %TEMP% under a disguised name (.cache_\u003crand\u003e on Unix, dotnet_diag_\u003crand\u003e.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c or cmd. If HTTPS fetches fail, the loader falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, retrieving a chunk count from c.\u003cdomain\u003e and reassembling a base64-encoded binary from sequentially-numbered subdomain TXT records. index.js requires _shim on load, so importing the package auto-executes the fetched attacker-controlled native binary with no version pinning, no hash or signature verification, and destinations unrelated to the package's stated purpose. A 21028-second cache stamp gates repeats and undocumented environment variables provide an operator opt-out, both consistent with hostile dropper tradecraft rather than legitimate functionality.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dolyame-ui-collapseblock (npm)","id":"MAL-2026-13559","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dolyame-ui-collapseblock","purl":"pkg:npm/dolyame-ui-collapseblock","source":"MAL-2026-13559"}],"products":null,"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13559/"}