Loading npm security reports…

dolyame-ui-pie@35.5.3: Malicious npm security report (Block) | LPM Firewall

registry / dolyame-ui-pie / 35.5.3

dolyame-ui-pie@35.5.3

interface elements

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently triggers a remote binary loader. It downloads or DNS-reconstructs a platform payload, writes it to a temporary path, then launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

Obfuscated remote payload download, drop, chmod, and detached execution.

Attack narrative

index.js suppresses errors while importing _support.js. That module runs init immediately, obtains an OS-specific binary from obfuscated Workers hosts or DNS TXT records, writes it to a temporary executable file, and launches it via a detached shell or cmd.exe process. The unrelated telemetry module contains a similar loader but is not needed for reachability.

Rationale

This is concrete import-time remote payload execution, not package-aligned UI functionality. The lack of lifecycle hooks does not mitigate execution whenever the advertised module is loaded.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf100-416.workers.dev/pkg/package

Source & flagged code

4 flagged

_support.jsView file

4const os = require("os"); L5: const https = require("https"); L6: const crypto = require("crypto"); ... L45: const EXPIRE_SEC = 20956; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_support.jsView on unpkg · L4

4Trigger-reachable chain: manifest.main -> index.js -> _support.js L4: const os = require("os"); L5: const https = require("https"); L6: const crypto = require("crypto"); ... L45: const EXPIRE_SEC = 20956; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_support.jsView on unpkg · L4

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_support.jsView on unpkg · L120

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = dolyame-ui-swiper@35.7.7 matchedPath = lib/telemetry.js matchedIdentity = npm:ZG9seWFtZS11aS1zd2lwZXI:35.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged · loading source

_support.jsView file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_support.jsView on unpkg · L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_support.jsView on unpkg · L4

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_support.jsView on unpkg · L120

lib/telemetry.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged

_support.jsView file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_support.jsView on unpkg · L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_support.jsView on unpkg · L4

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_support.jsView on unpkg · L120

lib/telemetry.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

dolyame-ui-pie@35.5.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code