registry / dolyame-ui-grid / 35.7.4

dolyame-ui-grid@35.7.4

interface elements

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous remote binary download-and-execute chain. It persists only a short-lived stamp/cache file but launches the downloaded binary detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js

Impact

Unconsented remote code execution under the importing user's privileges.

Mechanism

Obfuscated HTTPS/DNS payload retrieval, temp-file drop, chmod, detached shell execution

Attack narrative

Loading index.js silently requires _polyfill.js. Its run() function fetches a platform-specific binary from obfuscated HTTPS hosts, or reconstructs one from DNS TXT records, writes it into a temporary directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. A timestamp file merely rate-limits repeated execution.

Rationale

This is a concrete import-time remote payload execution chain unrelated to the declared UI-grid functionality. The absence of lifecycle hooks does not mitigate execution on ordinary package import.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_*TEMP/analytics_stateTEMP/dotnet_diag_*.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev

On require('dolyame-ui-grid'), index.js loads _polyfill.js which selects a platform-specific asset, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT chunked fallbacks under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or the Windows Temp directory under a disguised name (.cache_<rand> or dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via spawn('/bin/sh') or spawn('cmd'). Destination hostnames are assembled at runtime by.join('') on split string fragments, and a.analytics_state mtime file gates re-execution cadence, with comments framing the code as 'telemetry'/'analytics'. A parallel dropper implementation in lib/telemetry.js (base64-decoded chunks, chmodSync 0755, cp.spawn('/bin/sh',['-c', filePath+' &'])) is present but not reachable from the main require graph. The download hosts are unrelated to the package publisher, the fetched bytes are opaque and unverified, and execution happens unconditionally on module load.

dolyame-ui-grid@35.7.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code