registry / dolyame-ui-generateid / 35.8.1

dolyame-ui-generateid@35.8.1

Monitoring and observability SDK

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package immediately triggers a remote payload fetch and detached execution. The payload is downloaded from obfuscated HTTPS hosts or DNS TXT records and executed from a temporary directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of index.js.

Impact

Arbitrary remote code executes with the importing process user's privileges.

Mechanism

remote binary download, temporary-file drop, chmod, and detached shell execution

Attack narrative

Requiring index.js silently loads _shim.js. Its setup routine fetches a platform-specific payload from obfuscated Workers hosts, falling back to DNS TXT records, writes it to /var/tmp or Windows Temp, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The apparent telemetry library also embeds a configurable equivalent loader.

Rationale

This is confirmed import-time staged-payload execution, not normal telemetry behavior. The absence of an npm lifecycle hook does not mitigate the runtime RCE path.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js

Network endpoints7

oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf102-baf.workers.dev/pkg/package

On require() of the package, index.js loads _shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev, with a covert DNS TXT-record fallback that reads chunk counts from c.<domain> and base64 payload fragments from N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under disguised names such as.cache_<rand> or dotnet_diag_<rand>.exe, chmodded 0755 on POSIX, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start. A second import-reachable dropper path exists in lib/telemetry.js: it decodes base64 chunks into a Buffer, invokes fs["chmod"+"Sync"] with mode 0o755, and calls cp.spawn("/bin/sh", ["-c", filePath+" &"]). Anti-analysis techniques include split-string require("child_"+"process"), split-property fs["chmod"+"Sync"], array-join hostname assembly, and DNS TXT-record staged payload delivery. The package's stated purpose (a UI ID-generation helper / observability SDK) does not require fetching and executing native binaries from anonymous Cloudflare Workers domains.

dolyame-ui-generateid@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code