registry / dolyame-ui-notification / 35.5.4

dolyame-ui-notification@35.5.4

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a concealed remote-payload loader. It downloads or DNS-reconstructs a platform binary, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code execution under the importing user's privileges.

Mechanism

Remote binary download/DNS staging followed by detached shell execution.

Attack narrative

Normal import of index.js silently requires _compat.js. Its init routine selects a platform payload endpoint, downloads a binary from rotating worker hosts or obtains base64 payload data through DNS TXT records, saves it under a randomized temp filename, makes Unix payloads executable, and launches them detached through /bin/sh or cmd.exe.

Rationale

This is a concrete import-time staged payload loader and executor, unrelated to the advertised UI toolkit. The absence of install hooks does not mitigate runtime arbitrary code execution on import.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf9-9b3.workers.devoob-worker.cf102-baf.workers.dev

Package advertises itself as a UI notification toolkit but its main entry require()s./_compat.js, which on load randomly selects a destination from four obfuscated Cloudflare workers.dev hosts (oob-worker.cf9-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) reconstructed at runtime from split string arrays, with a DNS-TXT fallback channel over *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) that reassembles base64 fragments from sequential subdomain TXT records. It downloads a platform-specific native binary (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), writes it to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe under a cover-story filename, chmods 0755, and spawns it detached via /bin/sh or cmd. The runtime-reconstructed destinations, DNS-TXT covert channel, hidden staging paths with diagnostic-tool-lookalike filenames, and mismatch between the declared UI purpose and the fetch-and-execute behavior identify this as a supply-chain dropper rather than legitimate functionality.

dolyame-ui-notification@35.5.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code