registry / dolyame-ui-navigation / 35.7.3

dolyame-ui-navigation@35.7.3

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a bootstrap routine. It retrieves a platform-specific executable, saves it in a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote-controlled native code executes with the importing process's privileges.

Mechanism

Remote binary download/DNS staging followed by detached execution.

Attack narrative

At package import, index.js loads _compat.js, which invokes bootstrap without user action. The bootstrap selects a platform payload, fetches it from hard-coded worker hosts or reconstructs it from DNS TXT records, writes it to a temporary executable path, makes it executable on Unix, and launches it through a detached shell or cmd.exe process. The behavior is concealed behind telemetry-like names and silent error handling.

Rationale

This is a concrete import-time remote-code-execution chain unrelated to the advertised UI package. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf101-adf.workers.devoob-worker.cf102-baf.workers.dev

The package advertises itself as a UI navigation toolkit, but its main entry (index.js) require()s./_compat.js, which on load fetches a platform-specific executable from hardcoded Cloudflare Workers hosts assembled via array-join to evade static analysis (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) and falls back to DNS-TXT resolution against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded payload is written to /var/tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755, and spawned detached via /bin/sh -c on POSIX or cmd /c start /b on Windows. lib/telemetry.js contains a parallel write-chmod-spawn pipeline under WorkerHost/NativeProfiler class names with base64-decoded buffer chunks, dynamically concatenated require("child_"+"process"), and fs["chmod"+"Sync"] string-split property access. State is persisted to.analytics_state to blend with system files. The behavior fires on require() of the package, so any consumer that installs and imports dolyame-ui-navigation executes the attacker-controlled binary on their host.

dolyame-ui-navigation@35.7.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code