registry / dolyame-ui-group / 35.9.7

dolyame-ui-group@35.9.7

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically executes _loader.js. It fetches an opaque native payload, writes it to temporary storage, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary remote code execution under the importing user's privileges.

Mechanism

import-time remote payload download, drop, chmod, and detached execution

Attack narrative

Requiring index.js silently loads _loader.js. The loader rate-limits with a temporary marker, downloads a platform-specific binary from obfuscated worker hosts or reconstructs one through DNS TXT records, saves it in a temporary directory, makes it executable on Unix, and starts it through a detached shell or cmd.exe. The remote bytes have no enforced integrity check.

Rationale

This is a concrete import-time staged-payload execution chain unrelated to the advertised UI toolkit. It enables an attacker controlling the endpoints or DNS records to execute arbitrary code.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev

On require() of the package's main entry, _loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames reconstructed at runtime via array-join splits (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The downloaded bytes are written to a temp path with cover-story names (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on POSIX), chmod 0755, and spawned detached via /bin/sh -c or cmd. A second co-shipped dropper module lib/telemetry.js, styled as an analytics SDK, contains the same base64-decode -> write -> chmod 755 -> spawn("/bin/sh", ["-c", filePath+" &"]) chain. Sensitive API names are hidden via string concatenation (require("child_"+"process"), fs["chmod"+"Sync"], os["host"+"name"]()) to defeat static grep. Fetch-and-execute of an opaque, unversioned, non-publisher binary from anonymous workers.dev infrastructure at library-load time is arbitrary code execution on the installer's host.

dolyame-ui-group@35.9.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code