registry / dolyame-ui-constants / 35.5.9

dolyame-ui-constants@35.5.9

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently fetches a remote platform-specific binary or DNS-delivered payload, writes it to temporary storage, and executes it detached. This is concrete remote code execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary attacker-controlled code runs as the importing process user.

Mechanism

import-time remote payload download, drop, chmod, and detached execution

Attack narrative

Requiring index.js loads _support.js. It rate-limits via a temporary stamp, retrieves a binary from hard-coded workers.dev endpoints or DNS TXT records, writes it under a disguised temporary filename, grants execute permission on non-Windows systems, and starts it through a detached shell or cmd.exe process.

Rationale

The package’s normal import path implements an unconsented staged payload downloader and executor. This is malicious regardless of the absence of npm lifecycle scripts.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf101-adf.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf103-070.workers.dev

On require of the package, index.js loads _support.js which assembles Cloudflare Workers hostnames via split-string concatenation (`["oob-work","er.cf101-adf.workers.d","ev"].join("")`, plus cf102-baf and cf103-070 variants) with a DNS fallback to *.dl.wel1.ru. It downloads a platform-specific binary, writes it to /tmp or %TEMP% under deceptive names (`.cache_<hex>` on Linux/macOS, `dotnet_diag_<hex>.exe` on Windows to mimic a Microsoft diagnostic tool), chmods it 0755, and spawns it detached via `cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true})` (and `spawn("cmd",...)` on Windows). The payload is unsigned, unpinned, and unverified. Environment variables named `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, and `DO_NOT_TRACK` frame the behavior as telemetry, but the destinations, filename disguises, and execution pattern are dropper mechanics rather than telemetry. A second, larger parallel dropper implementation lives in lib/telemetry.js (base64-decoded buffers, `fs["chmod"+"Sync"]`, split-string `require("child_"+"process")`, `cp.spawn('/bin/sh',['-c',filePath+' &'])`), staged for activation. Installing or requiring this package causes attacker-controlled code to execute on the installer's host.

dolyame-ui-constants@35.5.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code