registry / dolyame-ui-menu / 35.6.1

dolyame-ui-menu@35.6.1

React components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a background payload downloader. It fetches a platform-specific binary, saves it to a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of dolyame-ui-menu

Impact

Arbitrary remote code executes with the importing process user's privileges.

Mechanism

Remote binary download, drop, and detached execution

Attack narrative

Requiring the package invokes _polyfill.js. Unless opt-out variables are set or a short-lived temp marker exists, it downloads a large platform-specific payload from hard-coded worker mirrors or DNS TXT records, writes it into a temp directory, marks Unix payloads executable, and starts it detached through /bin/sh or cmd.exe.

Rationale

This is a concrete import-time remote payload execution chain unrelated to the declared React-components purpose. The absence of lifecycle hooks does not mitigate runtime execution on import.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.devoob-worker.cf102-baf.workers.dev

The package is published as a React UI component library but on require('dolyame-ui-menu'), index.js loads _polyfill.js which fetches a platform-specific native binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked-base64 fallback channel over c./0./1./... subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. All destination hostnames are assembled at runtime via array.join to defeat static string matching. The fetched bytes are written to a disguised path in /tmp or %TEMP% using cover-story names such as.cache_<uid>, dotnet_diag_<uid>.exe, and a.analytics_state marker file, chmod'd 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe /c start /b, with no hash or signature verification. Execution is gated by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars and a filesystem TTL marker to avoid re-running in analysis environments. The advertised UI-library purpose is unrelated to any of this behavior.

dolyame-ui-menu@35.6.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code