registry / dolyame-ui-filter / 35.5.3

dolyame-ui-filter@35.5.3

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a hidden platform-specific binary downloader and launcher. It uses HTTPS with DNS TXT fallback, then executes the downloaded payload detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer requires/imports the package.

Impact

Arbitrary remote code executes with the privileges of the importing process.

Mechanism

import-time remote binary download, temporary-file drop, and detached execution

Attack narrative

Normal import of index.js silently loads _platform.js. Its import-time init downloads a platform-specific binary over HTTPS, falling back to DNS TXT chunk transfer, stores it under a randomized temporary filename, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is an unconsented remote payload execution chain unrelated to the advertised UI toolkit.

Rationale

The source establishes concrete import-time remote code execution, not merely telemetry behavior. No lifecycle hook is needed because the main entrypoint triggers it for package consumers.

Evidence

package.jsonindex.js_platform.jslib/telemetry.js

Network endpoints7

oob-worker.cf101-adf.workers.devoob-worker.cf100-416.workers.devoob-worker.cf99-9b3.workers.devsdk.dl.wel1.ru

dolyame-ui-filter@35.5.3 is advertised as a UI toolkit but its main entry loads _platform.js, which on require assembles destination hostnames at runtime via array.join('') to hide them from static inspection, resolving to Cloudflare Worker endpoints oob-worker.cf101-a.df.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf99-9b3.workers.dev, with a DNS TXT fallback that reads chunked base64 from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The module downloads a platform-specific binary via https.get, writes it to a temp path under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods 0755, and spawns it detached via cmd.exe or /bin/sh -c with unref(). Comments in the file mislabel the flow as telemetry/session dedup while the actual operation fetches and executes an opaque binary from an anonymous host. The delivery signals (anonymous Cloudflare Worker infrastructure with runtime-assembled hostnames, DNS TXT covert channel, decoy filenames impersonating.NET diagnostic tooling, detached background execution, purpose mismatch with the advertised UI package) satisfy the dropper fingerprint.

dolyame-ui-filter@35.5.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code