dolyame-ui-portalnpm
Advisory published Updated
dolyame-ui-portal is a confirmed malicious npm package (MAL-2026-13176) that steals credentials and exfiltrates sensitive data (malicious version 35.3.6). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in dolyame-ui-portal (npm)
What this malware does
index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames (oob-worker.cf10{0-3}-*.workers.dev) and a DNS-TXT discovery domain (sdk.dl.wel1.ru) from array-join string splits to hide them from static scanners, downloads a platform-specific binary over HTTPS, writes it to /var/tmp or %TEMP% under a cover-story name (.cache<hex> / dotnet_diag<hex>.exe), chmods it 0755, and detached-spawns it via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or spawn('cmd',...). The dropper is gated by opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) to evade sandboxed analysis. A parallel dropper is bundled at lib/telemetry.js under an 'Analytics SDK' cover story (base64-decoded payload chunks, chmod 755, /bin/sh -c spawn) that is not reached from the current require chain. Requiring or installing this package results in execution of attacker-controlled code from non-publisher infrastructure.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Search your lockfiles and build artifacts for dolyame-ui-portal (version 35.3.6).
If you installed it — respond
dolyame-ui-portal is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dolyame-ui-portal was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks dolyame-ui-portal-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.