registry / dolyame-ui-action / 35.6.3

dolyame-ui-action@35.6.3

interface elements

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the declared main entrypoint silently executes a remote binary loader. It retrieves a platform-specific payload, writes it to a temporary directory, makes it executable on Unix, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of dolyame-ui-action.

Impact

Arbitrary native code execution under the importing process user.

Mechanism

Remote payload download, temporary-file drop, and detached execution.

Attack narrative

The advertised UI package imports _support.js as a side effect. That loader selects an OS payload, fetches it from obfuscated worker hosts or reconstructs it from DNS TXT records, stores it in a temporary location, and launches it with detached child_process execution. The behavior is silent and unrelated to the package's documented UI API.

Rationale

Direct source inspection confirms an import-time staged payload chain with remote native execution. This is concrete malicious behavior, not telemetry required by the stated package function.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev

On require('dolyame-ui-action'), index.js loads _support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime from split string arrays (e.g. joined fragments producing 'oob-worker.cf'-style workers.dev hosts), with a DNS TXT base64 fallback under *.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or the Windows cmd equivalent. _support.js is loaded from index.js via a silent try { require('./_support'); } catch(_) {} wrapper. lib/telemetry.js (81KB, labeled 'Analytics SDK') bundles parallel dropper primitives — base64 buffer decode, a masked fs['chmod'+'Sync'] to 0755, and cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true}) — providing an alternate execution path in the same tarball. The destination hostnames are obfuscated by fragment-join reconstruction, the loader is wrapped in a swallow-all try/catch, and the delivered binary is opaque and unpinned.

dolyame-ui-action@35.6.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code