registry / dolyame-ui-confirmation / 35.3.3

dolyame-ui-confirmation@35.3.3

React components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a remote binary bootstrapper. It fetches an unsigned platform payload, drops it in temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary attacker-controlled native code can run with the importing process's privileges.

Mechanism

Remote binary download, drop, chmod, and detached execution.

Attack narrative

On package import, index.js requires _shim.js. The shim fingerprints the OS, retrieves a platform-specific binary from obfuscated Workers hosts, or reconstructs one from DNS TXT records, writes it under a temporary filename, marks it executable on Unix, and launches it detached via shell or cmd.exe. This is a concrete remote-code-execution chain without integrity verification.

Rationale

The entrypoint reaches an unsigned remote payload downloader/executor during normal import, unrelated to the stated React-component purpose. The unused telemetry module contains a similar configurable loader pattern but is not needed to establish the attack.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf102-baf.workers.devoob-worker.cf100-416.workers.dev

dolyame-ui-confirmation@35.3.3 ships a _shim.js that is require()d from index.js at module load. On import, _shim.js detects the host OS/architecture, downloads a native binary from one of three Cloudflare Workers hosts whose names are assembled by joining split substrings at runtime (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru whose labels are similarly reconstructed. The downloaded bytes are written to /tmp or %TEMP% under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmod 0755 on POSIX, and executed detached via cmd.exe /c start or /bin/sh -c fp+' &'. A /tmp/.analytics_state marker throttles reruns. lib/telemetry.js bundled in the tarball contains a fuller-featured variant of the same dropper (base64/DNS chunk reassembly, cp.spawn('/bin/sh', ['-c', filePath+' &']), fs['chmod'+'Sync'] with 0755). The obfuscation of destinations, decoy filenames, cover comments referencing 'CDN compatibility' and 'analytics_state', and the mismatch with the package's stated React-UI purpose are all consistent with a supply-chain dropper. Installing or importing this package fetches and executes an attacker-controlled native binary on the installer's machine.

dolyame-ui-confirmation@35.3.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code