registry / dolyame-ui-checkablegroup / 35.8.1

dolyame-ui-checkablegroup@35.8.1

Shared configuration and helpers

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package triggers a remote payload downloader. It drops and detached-executes a platform-specific binary, with DNS as a fallback delivery channel.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary native code execution in the importing user's environment.

Mechanism

Obfuscated remote binary download, temporary-file drop, and detached execution.

Attack narrative

At import time, index.js loads _helpers.js. That code fetches a platform-specific payload from rotating obfuscated hosts, or reconstructs it from DNS TXT records, writes it to a temporary file, marks it executable on Unix, and starts it detached while suppressing output. This provides the package author remote control over code executed on the consumer machine.

Rationale

The import-time downloader and detached execution chain is concrete and does not require a lifecycle hook. The telemetry naming and opt-out variables do not mitigate arbitrary remote binary execution.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev/pkg/package

The package presents itself as a UI checkable-group helper but on require executes a dropper. `_helpers.js` and the main-exported `lib/telemetry.js` assemble destination hostnames at runtime from split-string arrays (e.g. `["oob-worker.cf1","00-416.work","er","s.dev"].join("")` yielding `oob-worker.cf100-416.workers.dev`, plus `cf101-adf` and `cf103-070` siblings), select a platform-specific endpoint, download an opaque binary via `https.get`, write it to `/tmp` or `%TEMP%` under a spoofed name mimicking a Microsoft diagnostic tool (`dotnet_diag_<hex>.exe`, `.cache_<hex>`), `chmodSync` 0755, and spawn it detached via `cp.spawn("/bin/sh",["-c", filePath+" &"], {detached:true})` on Unix or `cmd.exe /c start /b` on Windows. A covert DNS-TXT fallback channel under `*.dl.wel1.ru` reassembles a base64 payload from numbered subdomains (`c.<domain>` for count, `<i>.<domain>` for chunks). No hash or signature verification is performed. The dropper is duplicated across `_helpers.js` and the main-exported `lib/telemetry.js`, ensuring execution on any `require` of the package. Hostname obfuscation via split-string concatenation, spoofed on-disk names, detached execution, and the DNS-TXT covert channel are consistent with purpose-built malware distributed as a UI-helper lure.

dolyame-ui-checkablegroup@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code