registry / dolyame-ui-popover / 35.8.7

dolyame-ui-popover@35.8.7

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently launches a remote payload loader. It fetches binaries, writes them into temporary storage, and executes them detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of index.js.

Impact

Arbitrary remote code execution under the importing user's privileges.

Mechanism

import-time download, drop, chmod, and detached execution of remote payloads

Attack narrative

On every import, index.js loads _ext.js. The loader contacts obfuscated Workers hosts for a platform-specific payload, with DNS TXT reconstruction through wel1.ru domains as fallback. It stores a marker to limit repeats, drops the received bytes to a temporary executable path, makes non-Windows files executable, and starts them detached through a shell or cmd.exe. This is unconsented remote code execution unrelated to the declared UI package.

Rationale

The package has a concrete import-time remote-binary execution chain. Its obfuscation, temporary payload staging, DNS fallback, and detached launch establish malicious intent.

Evidence

package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require() of the package, index.js loads _ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under deceptive filenames (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmodded 0755, and spawned detached via `/bin/sh -c "<path> &"` or `cmd.exe /c start /b`. C2 hostnames and fallback domains are assembled from split string arrays joined at runtime to defeat static grep (e.g. ["oob-worker.cf1","00-416.workers.dev"].join("") and ['sdk','.dl.wel1','.r','u'].join("")). A cache-stamp guard prevents re-execution. A co-shipped lib/telemetry.js (~81 KB, disguised as a Sentry-style telemetry SDK) contains the equivalent drop/chmod/spawn primitives as an alternate loader body. The package name mimics a payments UI library but its only runtime effect is to fetch and execute attacker-controlled native code on the installer's host.

dolyame-ui-popover@35.8.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code