dolyame-ui-popup@35.8.7: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The entrypoint attempts to load an embedded downloader/executor. As shipped, a duplicate const declaration prevents that helper from parsing, leaving the payload inert.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User code imports dolyame-ui-popup.

Impact

If the parse error is corrected, arbitrary remote native code would run under the importing process user.

Mechanism

Attempted remote binary download, temporary-file drop, chmod, and detached execution.

Rationale

The package contains an import-reachable remote binary loader, but a source-level syntax error stops it from executing in this version. This meets the inert payload carrier threshold for a warning, not a publish block.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf103-070.workers.devsdk.dl.wel1.ruext.dl.wel1.ru

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13175

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dolyame-ui-popup (npm)

Details

On require('dolyame-ui-popup'), index.js loads _helpers.js which immediately fetches a platform-specific binary from string-split Cloudflare Workers mirrors (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback across sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it to a hidden path under /tmp or the Windows temp directory (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. No hash or signature verification is performed and the destinations are assembled from split string fragments (['sdk.dl.w','el1.ru'].join(''); require('child_'+'process'); fs['chmod'+'Sync']) to defeat static analysis. lib/telemetry.js contains a second, structurally identical dropper labeled as an analytics SDK, using base64-over-DNS chunk assembly. The package advertises UI popup components but ships no UI code — the tarball's only effect on installation is fetching and executing an unverified remote binary under an attacker-controlled domain.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

index.js imports _helpers.js at package import time.
_helpers.js downloads platform binaries, including from oob-worker.cf102-baf.workers.dev.
_helpers.js can DNS-fetch a base64 payload from *.dl.wel1.ru, write it to /var/tmp or Windows Temp, chmod it, and spawn it.
The payload is hidden behind a telemetry-themed marker and opt-out variables.

Evidence against

package.json has no lifecycle scripts.
_helpers.js declares const _ppid twice in init(), a syntax error; index.js swallows the failed require, so this payload cannot execute as shipped.
lib/telemetry.js is not imported by the entrypoint; its native-loader path requires caller-supplied endpoints/mirrors.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.8 KB of source

Source & flagged code

4 flagged

_helpers.jsView file

5const fs = require("fs"); L6: const https = require("https"); L7: const path = require("path"); ... L45: const MAX_AGE = 20906; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_helpers.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _helpers.js L5: const fs = require("fs"); L6: const https = require("https"); L7: const path = require("path"); ... L45: const MAX_AGE = 20906; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_helpers.jsView on unpkg · L5

118try { L119: const cp = require("child_process"); L120: if (isWin) {

High

Child Process

Package source references child process execution.

_helpers.jsView on unpkg · L118

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = bi-core-bi-core-core@35.8.5 matchedPath = lib/telemetry.js matchedIdentity = npm:YmktY29yZS1iaS1jb3JlLWNvcmU:35.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged · loading source

_helpers.jsView file

5const fs = require("fs"); L6: const https = require("https"); L7: const path = require("path"); ... L45: const MAX_AGE = 20906; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_helpers.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _helpers.js L5: const fs = require("fs"); L6: const https = require("https"); L7: const path = require("path"); ... L45: const MAX_AGE = 20906; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_helpers.jsView on unpkg · L5

Findings

2 Critical2 High2 Medium1 Low

CriticalDownload Execute_helpers.js

CriticalTrigger Reachable Dangerous Capability_helpers.js

HighChild Process_helpers.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem