OpenSSF/OSV advisory MAL-2026-13510 confirms this npm version as malicious. The package's main entry unconditionally loads _ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback resolving to *.dl.wel1.ru, writes it to /tmp or %TEMP% under decoy names such as.cache_<uid> or...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in dolyame-ui-progresscircle (npm)
Details
The package's main entry unconditionally loads _ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback resolving to *.dl.wel1.ru, writes it to /tmp or %TEMP% under decoy names such as.cache_<uid> or dotnet_diag_<uid>.exe, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. Host names and sensitive API references (child_process, os.hostname, fs.chmodSync) are reassembled from split string arrays to evade static matching. lib/telemetry.js contains a redundant loader that base64-decodes embedded chunks, writes them to disk, chmods 0755, and detached-spawns the resulting binary. The package presents itself as a UI progress-circle / monitoring SDK but ships no functionality matching that description.
Decision reason
OpenSSF Malicious Packages via OSV confirms dolyame-ui-progresscircle@35.8.1 as malicious (MAL-2026-13510): Malicious code in dolyame-ui-progresscircle (npm)