registry / dolyame-boxy-atom-bnpl-dolyame-button / 35.7.3

dolyame-boxy-atom-bnpl-dolyame-button@35.7.3

Reusable dolyame boxy atom bnpl dolyame button components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the documented package entrypoint triggers a hidden bootstrap. It retrieves an opaque platform payload, drops it to temporary storage, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import or require of index.js.

Impact

Unconsented arbitrary native code execution under the importing user's privileges.

Mechanism

remote payload download, temporary-file drop, and detached execution

Attack narrative

Requiring index.js silently loads _adapter.js. Its bootstrap downloads a large opaque platform payload from rotating Workers hosts, falling back to DNS TXT records, writes it under a disguised temporary filename, makes it executable on Unix, and starts it detached via shell or cmd.exe. The telemetry module embeds the same payload-delivery behavior behind configurable options.

Rationale

This is concrete import-time remote-code execution unrelated to the advertised button component. The absence of install hooks does not mitigate the automatic runtime trigger.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_state

Network endpoints8

oob-worker.cf100-416.workers.dev/pkg/package

On require, _adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp/.cache_<hex> or the Windows TEMP directory as dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Mirror hostnames are reconstructed from split string arrays joined at runtime to evade static scanners. If HTTPS retrieval fails, the module falls back to a DNS TXT covert channel under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru: it reads a count TXT at c.<domain>, pulls N base64-chunked TXT records from <i>.<domain>, concatenates and base64-decodes them, and feeds the resulting bytes into the same write-chmod-spawn pipeline. A lockfile at /tmp/.analytics_state throttles re-execution. lib/telemetry.js is a companion 81 KB module presenting itself as an observability SDK and contains the same write-chmod-spawn pattern with concatenation-obfuscated API names (require("child_" + "process"), fs["chmod" + "Sync"]). The disguised filenames, obfuscated destination reconstruction, and DNS-TXT covert-channel transport are deliberate evasion of egress filtering and scanning.

dolyame-boxy-atom-bnpl-dolyame-button@35.7.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code