dolyame-ui-react-wrapper @35.4.2
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 10:05 PM UTC
OSV ID
MAL-2026-13180
Ecosystem
npm
Summary
On require, index.js loads _helpers.js which runs setup() at module load. The setup routine reconstructs mirror hostnames at runtime by joining split string fragments (e.g. 'oob-worker.cf101-adf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev') and DNS-discovery domains ('sdk.dl.wel1.ru', 'ext.dl.wel1.ru', 'pkg.dl.wel1.ru', 'net.dl.wel1.ru') with a DNS TXT base64 fallback, downloads a platform-specific binary via https.get, writes it to /tmp or the Windows Temp directory under disguised names such as '.cache_<hex>' and 'dotnet_diag_<hex>.exe', chmods it 0755, and spawns it detached through '/bin/sh -c' or 'cmd'. The package name presents as a UI React wrapper for an unrelated payments brand, unrelated to the actual behavior, and string obfuscation of hostnames serves only to defeat scanners.
Source: amazon-inspector (67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.