dolyame-ui-menunpm
Advisory published Updated
dolyame-ui-menu is a confirmed malicious npm package (MAL-2026-13167) that steals credentials and exfiltrates sensitive data (malicious version 35.6.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in dolyame-ui-menu (npm)
What this malware does
The package is published as a React UI component library but on require('dolyame-ui-menu'), index.js loads polyfill.js which fetches a platform-specific native binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked-base64 fallback channel over c./0./1./... subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. All destination hostnames are assembled at runtime via array.join to defeat static string matching. The fetched bytes are written to a disguised path in /tmp or %TEMP% using cover-story names such as.cache<uid>, dotnet_diag_<uid>.exe, and a.analytics_state marker file, chmod'd 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe /c start /b, with no hash or signature verification. Execution is gated by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars and a filesystem TTL marker to avoid re-running in analysis environments. The advertised UI-library purpose is unrelated to any of this behavior.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Search your lockfiles and build artifacts for dolyame-ui-menu (version 35.6.1).
If you installed it — respond
dolyame-ui-menu is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dolyame-ui-menu was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks dolyame-ui-menu-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.