registry / dolyame-ui-collapseblock / 35.8.1

dolyame-ui-collapseblock@35.8.1

Shared configuration and helpers

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package automatically starts a hidden downloader. It retrieves an unverified platform payload, saves it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

automatic remote binary download and detached execution

Attack narrative

index.js silently requires _shim.js at import time. The shim fetches a large platform-specific payload from concealed worker hosts, with DNS TXT reconstruction through .ru domains as fallback; it writes that payload into a temp path, marks it executable on Unix, and launches it via shell/cmd detached. This is an unconsented remote-code execution chain.

Rationale

The package has no install hook, but its normal import path automatically downloads and executes remote, unverified binaries. The claimed telemetry/profiler functionality does not justify hidden detached execution from unrelated hosts.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev/pkg/package

On require(), _shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via array-join to evade static inspection. The payload is written to /tmp or %TEMP% under a disguised name (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c or cmd. If HTTPS fetches fail, the loader falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, retrieving a chunk count from c.<domain> and reassembling a base64-encoded binary from sequentially-numbered subdomain TXT records. index.js requires _shim on load, so importing the package auto-executes the fetched attacker-controlled native binary with no version pinning, no hash or signature verification, and destinations unrelated to the package's stated purpose. A 21028-second cache stamp gates repeats and undocumented environment variables provide an operator opt-out, both consistent with hostile dropper tradecraft rather than legitimate functionality.

dolyame-ui-collapseblock@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code