registry / dolyame-boxy-block / 35.5.2

dolyame-boxy-block@35.5.2

Dolyame boxy block abstraction layer

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the advertised package automatically starts a background payload downloader. It fetches, writes, and detached-executes an unverified platform binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import of the package main entrypoint.

Impact

Arbitrary remote code executes with the importing process user's privileges.

Mechanism

remote binary download, DNS fallback, and detached execution

Attack narrative

The public entrypoint silently requires _runtime.js. On import, it fetches a platform-specific payload from rotating Workers hosts or reconstructs one from DNS TXT records, writes it to a temporary location, marks it executable on Unix, and spawns it detached through /bin/sh or cmd.exe. The execution is hidden and repeat runs are suppressed by a temporary marker.

Rationale

This is concrete automatic remote payload execution unrelated to the documented abstraction API. No install hook is needed because ordinary package import activates the chain.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev/pkg/package

dolyame-boxy-block@35.5.2 ships a `_runtime.js` module that is unconditionally required from `index.js` at load time. On import, `_runtime.js` reconstructs attacker-controlled hostnames from split string arrays (e.g. `["oob-wor","ker.cf99-9b3.workers.dev"].join("")` producing `oob-worker.cf99-9b3.workers.dev`, and similar for `oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf103-070.workers.dev`), performs an `https.get` to a platform-specific endpoint, writes the returned bytes to `/var/tmp` or `%TEMP%` under a decoy filename (`.cache_<rand>` on POSIX, `dotnet_diag_<rand>.exe` on Windows), `chmod 0755`s the file, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd.exe` with `stdio:"ignore"` and `.unref()`. If the HTTPS mirrors fail, a DNS-TXT covert channel under `sdk.dl.wel1.ru` / `ext.dl.wel1.ru` / `pkg.dl.wel1.ru` / `net.dl.wel1.ru` retrieves a base64-encoded payload chunked across multiple TXT records (`c.<domain>`, `0.<domain>`, `1.<domain>`...), reassembles it, and executes it through the same write-and-spawn sink. The advertised purpose ("boxy block" UI library) does not match the shipped behavior; the hostnames are obfuscated to evade static string search; the fetched binary is unpinned, unhashed, and unsigned. Any consumer that `require()`s or `import`s the package triggers full-host remote code execution.

dolyame-boxy-block@35.5.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code