registry / dolyame-boxy-component-story-name / 35.3.3

dolyame-boxy-component-story-name@35.3.3

Reusable dolyame boxy component story name components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently triggers a remote payload downloader. It stores and detached-executes an opaque platform-specific binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js

Impact

Unconsented remote code execution under the importing process's user account.

Mechanism

HTTPS/DNS staged payload download, temp-file drop, and detached shell execution

Attack narrative

The public entrypoint catches and suppresses errors while automatically requiring _support.js. That module fetches a platform-specific binary from rotating hosts, or reconstructs one from DNS TXT records, writes it to a temporary location, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is a concrete staged remote-code-execution chain activated by ordinary package import.

Rationale

The import-time downloader and detached execution of unverified remote bytes are concrete malicious behavior, not telemetry. Lack of an npm lifecycle hook does not mitigate the runtime import trigger.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package

On require() of this package, _support.js reconstructs Cloudflare Workers hostnames from split string fragments (e.g. 'oob-work'+'er.cf101-ad'+...+'workers.'+'dev'), fetches a platform-specific executable, with a DNS-TXT chunked fallback via '*.dl.wel1.ru' (also reconstructed from fragments like ['sdk','.dl.wel1','.r','u'].join('')), writes it to a hidden randomized filename under /tmp (or %TEMP%), sets mode 0755, and spawns it detached and orphaned via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution is gated by a TTL stamp file to run at most once per ~23000 seconds. A parallel dropper implementation ships in lib/telemetry.js with additional obfuscation (require('child_'+'process'), fs['chmod'+'Sync'], base64-assembled payload chunks) framed as an APM telemetry SDK. The package's stated purpose is a reusable component library, so the fetch-and-execute pipeline is entirely covert. The delivered bytes are attacker-controlled and opaque, yielding arbitrary code execution on the installer's host on import.

dolyame-boxy-component-story-name@35.3.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code