OpenSSF/OSV advisory MAL-2026-13602 confirms this npm version as malicious. On require of the package, index.js loads lib/telemetry.js and _polyfill.js, both of which contain dropper logic that selects an OS-specific path, fetches a binary from one of three obfuscated Cloudflare Workers URLs (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-over-DNS-TXT fallback from *.dl.wel1.ru, writes the payload to a temp path under...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in dolyame-ui-tabslayout (npm)
Details
On require of the package, index.js loads lib/telemetry.js and _polyfill.js, both of which contain dropper logic that selects an OS-specific path, fetches a binary from one of three obfuscated Cloudflare Workers URLs (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-over-DNS-TXT fallback from *.dl.wel1.ru, writes the payload to a temp path under cover names such as dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames and dangerous API references are assembled at runtime by string-splitting concatenation (e.g. ['oob-worker.cf102-baf','.worke','rs.dev'].join(''), require('child_' + 'process'), fs['chmod'+'Sync']) to evade static scanners. The package presents itself as build/deployment tooling and wraps the dropper inside a fake Sentry-style analytics SDK.
Decision reason
OpenSSF Malicious Packages via OSV confirms dolyame-ui-tabslayout@35.8.1 as malicious (MAL-2026-13602): Malicious code in dolyame-ui-tabslayout (npm)