OpenSSF/OSV advisory MAL-2026-13578 confirms this npm version as malicious. On require() of the package, _adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments (oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, with DNS fallback to *.dl.wel1.ru), fetch an opaque binary payload over HTTPS (base64 chunked, with a DNS-TXT fallback path), write the bytes to /tmp/.cache_<hex> on Unix or...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in dolyame-ui-inputfio (npm)
Details
On require() of the package, _adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments (oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, with DNS fallback to *.dl.wel1.ru), fetch an opaque binary payload over HTTPS (base64 chunked, with a DNS-TXT fallback path), write the bytes to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod the file to 0755, and spawn it detached via /bin/sh -c or cmd. Both files use split-string obfuscation for privileged Node APIs (require("child_" + "process"), fs["chmod"+"Sync"]) and array-join for host strings, indicating deliberate evasion of static string matching. The main export lib/telemetry.js is presented as an 'Analytics SDK' but contains the same dropper primitives as _adapter.js. The behavior fires unconditionally when the package is imported.
Decision reason
OpenSSF Malicious Packages via OSV confirms dolyame-ui-inputfio@35.8.1 as malicious (MAL-2026-13578): Malicious code in dolyame-ui-inputfio (npm)