registry / dolyame-ui-checkable / 35.4.1

dolyame-ui-checkable@35.4.1

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main entrypoint immediately starts a remote payload loader. It retrieves a binary over HTTPS or DNS TXT, drops it in a temp directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import of index.js

Impact

Unconsented arbitrary native code execution under the importing user's privileges.

Mechanism

remote binary download, temporary-file drop, and detached execution

Attack narrative

Requiring the package loads setup.js. Its run() function fetches a platform-specific payload from obfuscated workers.dev mirrors, or reconstructs one from DNS TXT records, writes it to a temporary path, sets executable permission on Unix, and launches it detached via shell/cmd. The large telemetry module duplicates this payload-loader design behind configurable endpoints.

Rationale

This is concrete import-time remote code execution, not ordinary telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the declared main entrypoint.

Evidence

package.jsonindex.jssetup.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.dev

index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of Cloudflare workers.dev mirror hosts (e.g. oob-worker.cf103-070.workers.dev) via array.join string-splitting, downloads a platform-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<rand>.exe,.cache_<rand>), chmods it 0755 on POSIX, and spawns it detached via cmd.exe or /bin/sh -c. When HTTPS mirrors fail, setup.js queries DNS TXT records on numeric subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenates the chunks, base64-decodes them into a binary, writes it to disk, and executes it — a DNS-tunneled executable delivery channel designed to bypass HTTPS egress filtering. lib/telemetry.js contains a second copy of the same dropper primitives (require("child_"+"process"), fs["chmod"+"Sync"], cp.spawn("/bin/sh", ["-c", filePath+" &"], {detached: true})) wrapped in Sentry-lookalike SDK framing. String-splitting of hostnames and API names, mismatch between the advertised "UI checkable" purpose and the fetch-and-exec behavior, use of anonymous workers.dev endpoints, and the DNS-TXT covert channel together characterize a hostile install/import-time dropper.

dolyame-ui-checkable@35.4.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code