dolyame-ui-flag@35.7.6: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a hidden remote payload bootstrapper. It downloads or DNS-reconstructs a platform binary, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of the package entrypoint.

Impact

Arbitrary native code execution in the consuming user's environment.

Mechanism

import-time remote binary download and detached execution

Attack narrative

The declared entrypoint silently requires _vendor.js. Its bootstrap runs on import, selects a platform-specific endpoint, fetches a binary from rotating hosts or DNS TXT records, writes it under a disguised temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The marker only rate-limits repeated execution and environment variables merely provide opt-out names.

Rationale

This is a concrete import-time remote payload execution chain unrelated to the advertised UI toolkit. The absence of lifecycle hooks does not mitigate arbitrary code execution on normal package use.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf102-baf.workers.devoob-worker.cf101-adf.workers.dev

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13155

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dolyame-ui-flag (npm)

Details

On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS-TXT chunked base64 fallback resolved via sdk.dl.wel1.ru, writes it to /tmp or the Windows Temp directory under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods 755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. Destination hostnames and dangerous APIs are assembled by array-join and string concatenation (e.g. require("child_"+"process"), fs["chmod"+"Sync"]) to hinder pattern-matching. A second, structurally identical dropper is shipped in lib/telemetry.js under an 'Analytics SDK' label, providing a backup payload vector. The advertised purpose (a UI flag component) has no relationship to fetching and executing opaque native binaries from anonymous Workers hosts.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _vendor at package import time.
_vendor.js downloads platform binaries from obfuscated workers.dev hosts.
_vendor.js falls back to DNS TXT payload retrieval.
_vendor.js writes payloads to temp storage, chmods them, then detached-spawns them.
The downloaded payload has no enforced hash/signature verification despite the integrity comment.

Evidence against

package.json has no lifecycle scripts.
The public UI API itself is minimal and does not invoke telemetry.js.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.5 KB of source

Source & flagged code

4 flagged

_vendor.jsView file

2L3: const https = require("https"); L4: const crypto = require("crypto"); ... L47: const STAMP_TTL = 22219; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_vendor.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js -> _vendor.js L2: L3: const https = require("https"); L4: const crypto = require("crypto"); ... L47: const STAMP_TTL = 22219; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_vendor.jsView on unpkg · L2

122try { L123: const cp = require("child_process"); L124: if (isWin) {

High

Child Process

Package source references child process execution.

_vendor.jsView on unpkg · L122

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = bpm-foundation-sentry@35.8.7 matchedPath = lib/telemetry.js matchedIdentity = npm:YnBtLWZvdW5kYXRpb24tc2VudHJ5:35.8.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged · loading source

_vendor.jsView file

2L3: const https = require("https"); L4: const crypto = require("crypto"); ... L47: const STAMP_TTL = 22219; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_vendor.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js -> _vendor.js L2: L3: const https = require("https"); L4: const crypto = require("crypto"); ... L47: const STAMP_TTL = 22219; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_vendor.jsView on unpkg · L2

122try { L123: const cp = require("child_process"); L124: if (isWin) {

Findings

2 Critical2 High2 Medium1 Low

CriticalDownload Execute_vendor.js

CriticalTrigger Reachable Dangerous Capability_vendor.js

HighChild Process_vendor.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem