registry / dolyame-ui-deprecatepropshoc / 35.8.1

dolyame-ui-deprecatepropshoc@35.8.1

Internal utility module

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package immediately starts a background downloader. It retrieves an opaque platform payload, stores it in a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import of index.js

Impact

Unconsented arbitrary native code execution on the importing host.

Mechanism

Remote payload download, drop, chmod, and detached execution

Attack narrative

At import time, index.js loads _adapter.js. Its main routine fetches a platform-specific opaque binary from rotating workers.dev hosts, with DNS TXT payload retrieval from wel1.ru as fallback. It writes the bytes to a concealed temporary filename, applies execute permissions on non-Windows systems, and spawns it detached; the telemetry module duplicates this capability.

Rationale

This is a concrete import-triggered remote-code-execution chain, not legitimate telemetry behavior. No lifecycle hook is needed because normal dependency import activates it.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_*%TEMP%/analytics_state%TEMP%/dotnet_diag_*.exe

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.dev

On require(), dolyame-ui-deprecatepropshoc@35.8.1 side-effect-loads _adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments (['oob-worker.cf101-adf.','wor','kers.dev'].join('')) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, fetch a platform-specific opaque binary (/pkg/package, /pkg/loader_mac, /pkg/package.exe), write it to /var/tmp/.cache_<uid> or %TEMP%\dotnet_diag_<uid>.exe, apply mode 0755 via fs['chmod'+'Sync'], and spawn it detached through /bin/sh -c or cmd.exe /c start /b. child_process is loaded via require('child_'+'process') to evade static matching. There is no version pin, hash, or signature verification on the fetched executable. The dropper is duplicated inside lib/telemetry.js — the module referenced by index.js's module.exports — so the payload deploys even if _adapter.js is removed. The 'telemetry'/'analytics_state'/'dotnet_diag_' naming is a cover story; the behavior is remote-code execution on the installer at require() time.

dolyame-ui-deprecatepropshoc@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code