registry / dolyame-ui-input / 35.7.6

dolyame-ui-input@35.7.6

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main package silently triggers a remote binary downloader and executor. It uses HTTP mirrors or DNS TXT records, then launches the payload detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js.

Impact

Arbitrary remote native code executes under the importing user's privileges.

Mechanism

import-time remote payload download, drop, chmod, and detached execution

Attack narrative

The package main entrypoint catches and suppresses a require of _shim.js. That shim immediately fetches a platform-specific binary from hard-coded worker hosts, or reconstructs one from DNS TXT records. It writes the bytes to a temporary executable path, marks non-Windows files executable, and launches them detached through cmd.exe or /bin/sh. The payload source is unauthenticated and remote-controlled.

Rationale

This is a concrete import-time remote-code-execution chain unrelated to the advertised UI input package. The duplicated telemetry implementation contains the same downloader pattern but is not needed to establish the active attack surface.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev/pkg/package

dolyame-ui-input@35.7.6 is published as a React component library but ships no UI code. On require(), index.js loads _shim.js, which downloads a platform-specific binary from split-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). If HTTPS mirrors fail, the payload is reassembled from base64-encoded DNS TXT records across subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and passed through the same write+chmod+spawn path. Hostnames, module names (child_process, chmodSync), and paths are constructed by joining split fragments to defeat static analysis; comments falsely reference SHA-256 integrity checks though no verification is performed. A sibling module lib/telemetry.js contains parallel drop-and-execute logic (base64 buffer assembly, chmod 0755, spawn /bin/sh -c filePath+' &') though it is not currently on the require() path. Destinations are not publisher-controlled, the payload is unpinned and unverified, and execution is fully automatic on module load.

dolyame-ui-input@35.7.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code