registry / dolyame-ui-attachfile / 35.8.1

dolyame-ui-attachfile@35.8.1

Monitoring and observability SDK

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package immediately starts an asynchronous remote-payload loader. It fetches a platform-specific executable, stores it in a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary code execution in the importing user's context.

Mechanism

Remote binary download/DNS staging followed by detached execution.

Attack narrative

At import time, index.js loads _shim.js. The shim selects a platform-specific endpoint, downloads a payload from concealed hard-coded hosts or DNS TXT records, writes it to a temporary path, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is an unverified staged-payload execution chain.

Rationale

The package contains concrete import-time, unverified remote binary execution rather than telemetry-only behavior. The lack of install hooks does not reduce the runtime RCE risk.

Evidence

index.js_shim.jslib/telemetry.jspackage.json/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.de/pkg/package

On require of the package's main entry, index.js loads./lib/telemetry and./_shim. Both modules implement an import-time dropper: they select a platform-specific asset path, download opaque bytes from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, write the payload to /var/tmp or %TEMP% under a disguised name (dotnet_diag_*.exe,.cache_*), chmod 0755, and spawn it detached via /bin/sh -c or cmd /c start. Destination hostnames and DNS domains are reconstructed at runtime from split-string arrays joined together, and API names are broken up (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static scanners. The package name impersonates a fintech (dolyame) while its shipped code is an anonymous native-binary loader with no hash or signature verification and no user consent. The Cloudflare Workers hosts and.dl.wel1.ru domains are not documented first-party endpoints for the package's stated purpose.

dolyame-ui-attachfile@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code