registry / dolyame-ui-datatable / 35.8.1

dolyame-ui-datatable@35.8.1

Shared configuration and helpers

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package silently fetches a platform-specific binary or DNS-encoded payload and executes it detached. The behavior is concealed as analytics initialization and persists briefly through a timestamp file.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code execution under the importing process user.

Mechanism

Remote binary download/DNS staging followed by temp-file execution.

Attack narrative

Requiring index.js loads _platform.js, which immediately calls main(). It selects a platform asset, downloads it from obfuscated Worker domains or reconstructs it from DNS TXT records, writes it to a temporary file, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The package contains no legitimate datatable implementation supporting this behavior.

Rationale

The concrete import-time remote-payload download and detached execution chain establishes malicious behavior. Lack of an npm lifecycle hook does not reduce the runtime RCE impact.

Evidence

index.js_platform.jslib/telemetry.jspackage.json/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf101-adf.workers.dev/pkg/package

The package's main entry requires _platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru, writes it to /tmp or Windows TEMP with an innocuous name (dot-prefixed cache file or dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at runtime from split-string arrays joined with.join(''), and require('child_process') is likewise assembled as require('child_' + 'process') to evade static matching. A second equivalent dropper path exists in lib/telemetry.js (also reachable via package main), providing redundant execution of arbitrary fetched bytes. The package is named 'dolyame-ui-datatable' with description 'Shared configuration and helpers' but contains no UI or datatable code — only the loader and dropper — consistent with a typosquat/dependency-confusion carrier. No signature or hash verification is performed on the downloaded payload.

dolyame-ui-datatable@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code