registry / dolyame-ui-mixins / 35.1.4

dolyame-ui-mixins@35.1.4

interface elements

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the declared main entrypoint silently triggers a remote payload downloader and detached execution. The payload is fetched by HTTPS or DNS TXT fallback, stored in a temporary directory, then launched.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary code execution as the importing user's account.

Mechanism

Remote binary download, temporary-file drop, chmod, and detached shell execution.

Attack narrative

The main entrypoint suppresses errors while requiring _ext.js. On import, _ext.js fetches a platform-specific binary from hard-coded obfuscated hosts, falling back to DNS TXT payload reconstruction. It writes the payload to a temporary path, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe without validating its origin or contents.

Rationale

This is concrete import-time remote payload execution unrelated to the advertised UI mixins package. The dormant telemetry module repeats the same downloader/launcher pattern, reinforcing intentional staging behavior.

Evidence

package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.dev

On require of dolyame-ui-mixins, index.js loads./_ext, which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32) and downloads an opaque native binary over HTTPS from one of three Cloudflare workers.dev hosts whose names are reconstructed by array-join to evade static inspection (e.g. ["oob-worker.cf103","-070.wo","rkers.d","ev"].join("") yielding oob-worker.cf103-070.workers.dev, plus oob-worker.cf100-416.workers.dev and oob-worker.cf102-baf.workers.dev). A DNS TXT covert-channel fallback resolves base64 chunks from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp (or the Windows TEMP directory) under disguised filenames of the form.cache_<hex> or dotnet_diag_<hex>.exe, chmod'd 0755 via fs["chmod"+"Sync"], and spawned detached through /bin/sh -c or cmd.exe with.unref(). There is no version pin, no hash or signature verification, and no relationship between the fetched binary and the package's stated purpose of providing UI mixins. A second, parallel dropper is shipped in lib/telemetry.js under an 'Analytics SDK' cover story, using require("child_"+"process"), base64 DNS-chunk assembly, chmod 0755, and /bin/sh -c spawn against the same infrastructure pattern.

dolyame-ui-mixins@35.1.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code