registry / dolyame-ui-list / 35.2.6

dolyame-ui-list@35.2.6

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an unconsented remote payload downloader. It writes and detached-executes the downloaded binary on the consumer machine.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of dolyame-ui-list

Impact

Remote code execution with the permissions of the importing process.

Mechanism

Obfuscated HTTPS/DNS payload download followed by temp-file execution

Attack narrative

Requiring index.js silently loads _vendor.js. Its setup routine retrieves a platform-specific payload from obfuscated Workers hosts or reconstructs one from DNS TXT records, writes it to a temporary executable path, marks it executable on non-Windows systems, and starts it detached through /bin/sh or cmd.exe.

Rationale

This is a concrete import-time remote-code-execution chain unrelated to the advertised visual-component package. Absence of lifecycle hooks does not mitigate the automatic runtime trigger.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf102-baf.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.dev

On require() of dolyame-ui-list, index.js loads _vendor.js which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS TXT fallback discovery channel under *.dl.wel1.ru. Destination hostnames and API names are obfuscated via array-fragment join("") and dynamic member access (e.g. require("child_" + "process"), fs["chmod" + "Sync"]). The fetched bytes are written to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows (a lookalike name imitating a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No version pin, no hash or signature verification, and the hosts are not the publisher's infrastructure. Environment variables DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are checked as a cover story consistent with a telemetry SDK. A second full copy of the same dropper ships as lib/telemetry.js (81 KB) with identical primitives, providing an alternate loader path. The package name resembles the Russian BNPL vendor Dolyame's UI ecosystem but the behavior matches no legitimate use.

dolyame-ui-list@35.2.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code