registry / dolyame-ui-radio / 35.2.2

dolyame-ui-radio@35.2.2

interface elements

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a hidden remote binary loader. It fetches or DNS-reconstructs a payload, drops it to a temporary path, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of the package entrypoint.

Impact

Arbitrary native code execution under the importing user's privileges.

Mechanism

Import-time remote payload download, drop, and detached execution.

Attack narrative

Requiring index.js silently requires _adapter.js, which immediately calls start(). The loader fetches a platform-specific binary from rotating worker hosts or reconstructs one from DNS TXT records, writes it to a concealed temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. Its telemetry opt-out variables, cache marker, obfuscated host construction, and swallowed errors conceal this behavior.

Rationale

The import-time loader is a concrete remote native-code execution chain unrelated to the advertised UI component package. It is sufficient for a blocking malicious verdict.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf103-070.workers.devoob-worker.cf100-416.workers.dev

dolyame-ui-radio@35.2.2 is a dropper disguised as a UI/telemetry package. index.js unconditionally require()s./_adapter.js, which on module load downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under masquerading names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Destination hostnames are assembled from split-and-joined string fragments; cache paths and opt-out env-var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK,.analytics_state) present a telemetry cover story that does not match the observed drop-and-exec behavior. A second copy of the same drop-and-exec logic (base64 chunk assembly, chmodSync 0755, spawn /bin/sh) is bundled in lib/telemetry.js, unreached in this version's import graph but shipped in the tarball. Any require() or import of this package executes attacker-controlled native code on the installer's host.

dolyame-ui-radio@35.2.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code