dolyame-ui-attachfilenpm
Advisory published Updated
dolyame-ui-attachfile is a confirmed malicious npm package (MAL-2026-13504) that typosquats a legitimate package to trick installs (malicious version 35.8.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in dolyame-ui-attachfile (npm)
What this malware does
On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a platform-specific asset path, download opaque bytes from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, write the payload to /var/tmp or %TEMP% under a disguised name (dotnet_diag.exe,.cache_), chmod 0755, and spawn it detached via /bin/sh -c or cmd /c start. Destination hostnames and DNS domains are reconstructed at runtime from split-string arrays joined together, and API names are broken up (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static scanners. The package name impersonates a fintech (dolyame) while its shipped code is an anonymous native-binary loader with no hash or signature verification and no user consent. The Cloudflare Workers hosts and.dl.wel1.ru domains are not documented first-party endpoints for the package's stated purpose.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Search your lockfiles and build artifacts for dolyame-ui-attachfile (version 35.8.1).
If you installed it — respond
dolyame-ui-attachfile is a typosquat — you almost certainly intended a legitimately-named package. Remove dolyame-ui-attachfile, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If dolyame-ui-attachfile was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks dolyame-ui-attachfile-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.