registry / dolyame-ui-pagination / 35.2.5

dolyame-ui-pagination@35.2.5

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an unconsented remote binary downloader and detached execution. It uses both HTTPS mirrors and DNS TXT as payload delivery channels.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of dolyame-ui-pagination.

Impact

Remote operator-controlled code executes with the importing process's privileges.

Mechanism

import-time download, temp-file drop, chmod, and detached shell execution

Attack narrative

The public entrypoint silently requires _polyfill.js. At import time it fetches a platform-selected binary via concealed HTTPS hosts or DNS TXT records, writes it to a temporary path, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is a concrete remote-code-execution chain unrelated to the declared UI pagination functionality.

Rationale

This package contains a reachable, import-time remote payload download-and-execute chain. No install hook is needed for the behavior to affect any application that imports it.

Evidence

index.js_polyfill.jspackage.jsonREADME.mdlib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf100-416.workers.devoob-worker.cf99-9b3.workers.dev

On require of the package, index.js loads./_polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at runtime via array-join string splitting to evade static matching, resolving to Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev). A platform-specific binary is downloaded, written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod'd to 0755, and spawned detached via /bin/sh -c or cmd. A secondary covert channel resolves TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-decoding the concatenated TXT fragments into an executable buffer when the HTTPS mirrors fail. A sibling module lib/telemetry.js ships the same dropper primitives (base64-decoded buffer, split-property fs['chmod'+'Sync'], /bin/sh spawn) though it is not on the entrypoint graph from index.js. Destinations are unrelated to the package's stated purpose (a UI pagination component), unpinned, and unverified; the fetched bytes are opaque and executed.

dolyame-ui-pagination@35.2.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code