registry / dolyame-ui-editor / 35.6.6

dolyame-ui-editor@35.6.6

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main entrypoint automatically runs a remote binary loader. It fetches a platform payload, writes it to temporary storage, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js

Impact

Arbitrary native code execution under the importing user's permissions.

Mechanism

Remote payload download, drop, chmod, and detached execution

Attack narrative

The package’s declared main file catches errors while importing _loader.js, so normal runtime import silently activates it. The loader retrieves a large platform-specific binary over HTTPS or reconstructs one from DNS TXT records, drops it under a benign-looking temporary filename, makes it executable on Unix, and launches it detached. This is an unconsented remote-code execution chain, not functionality needed by the exposed UI API.

Rationale

Direct source inspection confirms an import-time downloader/dropper/executor with concealed endpoints and no payload validation. The absence of an npm lifecycle hook does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

dolyame-ui-editor 35.6.6 is not a UI editor. index.js unconditionally requires./_loader on module load. _loader.js selects a platform-specific asset, obfuscates its destination hostnames via array.join() (e.g. 'oob-worker.cf99-9b3.workers.dev' and 'sdk.dl.wel1.ru'), fetches an opaque binary over HTTPS from a rotated list of Cloudflare Workers hosts with a DNS TXT-record fallback channel, writes it under /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe with disguised names, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. child_process is loaded via require("child_"+"process") and chmodSync is accessed via fs["chmod"+"Sync"] to evade static scanners. lib/telemetry.js ships an 81KB mirror of the same drop-and-execute primitives (endpoint rotation, DNS-based service discovery, base64-decoded buffer, chmodSync 0755, detached /bin/sh spawn), staged for later activation. No hash or signature verification of the fetched payload; destinations are unrelated to any stated 'visual components' purpose and the fetched bytes are opaque. The package is a lure whose install/require executes attacker-controlled code on the installer's host.

dolyame-ui-editor@35.6.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code