registry / dolyame-ui-clickable / 35.6.2

dolyame-ui-clickable@35.6.2

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a remote binary downloader and detached execution path. It persists a short-lived marker and drops payloads into system temporary directories.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary attacker-supplied native code can execute under the importing process user.

Mechanism

Remote payload download, temporary-file drop, chmod, and detached shell execution.

Attack narrative

The public entrypoint silently loads _init.js during import. That code selects a platform payload endpoint, retrieves a binary from obfuscated Workers hosts or DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached through a shell or cmd.exe. This is a concrete remote-code-execution chain without user action beyond importing the package.

Rationale

The import-time execution chain is directly present in source and downloads then launches untrusted remote content. No lifecycle hook is required for the package to execute the payload when used.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

On require() of the package, index.js unconditionally loads _init.js, which selects a platform-specific endpoint (linux_x64, linux_arm64, darwin, win32) and downloads a native binary from a rotating list of anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmod'd 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or the Windows equivalent. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to evade static matching, and the code is framed with cover-story comments as analytics/telemetry. A second, ~81 KB copy of the same fetch-and-execute pattern ships in lib/telemetry.js, using the same string-split evasion and a base64-decoded payload piped to /bin/sh with chmod 0755. The declared purpose (a UI-components package) has no need for native binary execution from anonymous infrastructure.

dolyame-ui-clickable@35.6.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code