registry / dolyame-ui-draggable / 35.4.6

dolyame-ui-draggable@35.4.6

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package starts a silent remote-payload loader. It downloads or DNS-reconstructs a platform-specific binary, drops it to a temp directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import of index.js.

Impact

Unconsented remote code execution as the importing process user.

Mechanism

Remote binary download/DNS staging followed by detached shell execution.

Attack narrative

The main entrypoint silently imports _runtime.js. That module runs immediately, retrieves a platform-specific payload from hard-coded HTTPS hosts or DNS TXT records, writes it into a temporary executable file, and launches it detached through cmd.exe or /bin/sh. This is concrete remote code execution unrelated to the advertised UI package.

Rationale

Source inspection confirms an import-time staged binary loader and detached execution chain. No benign package function requires this behavior.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.dev

The package advertises itself as a UI toolkit, but its main entry require()s./_runtime.js, which on load downloads a platform-specific binary from author-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}).unref(). Host and domain strings are assembled at runtime from split-string arrays (e.g. ['sdk.dl.w','el1.r','u'].join("")) to evade static grep, and a DNS-TXT base64 fallback channel is provided via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Execution is gated on the absence of DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and rate-limited via a /tmp/.analytics_state mtime stamp; comments frame the behavior as 'telemetry' cleanup. Filenames (.cache_*, dotnet_diag_*.exe) are chosen to blend into system tmp contents. The download-and-execute path has no relationship to the stated UI-toolkit purpose.

dolyame-ui-draggable@35.4.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code