registry / dolyame-ui-react-dom-wrapper / 35.8.9

dolyame-ui-react-dom-wrapper@35.8.9

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a hidden loader. It retrieves a binary payload, writes it to temporary storage, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of the package entrypoint.

Impact

Arbitrary attacker-controlled code execution as the importing process user.

Mechanism

remote binary download, drop, chmod, and detached execution

Attack narrative

The entrypoint suppresses errors while importing _helpers.js. Its top-level setup fetches a platform-specific payload from rotating workers.dev hosts or DNS TXT records, stores it under a randomized temporary filename, marks non-Windows files executable, and starts it detached. This is an import-triggered staged remote-code-execution loader disguised as telemetry.

Rationale

Direct source inspection confirms an import-time remote payload loader and detached execution chain. The absent npm lifecycle hook does not mitigate the runtime compromise.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev

On require of the package's main entry, _helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlled Cloudflare Worker subdomains (oob-worker.cf99-9b3.workers.dev, cf103-070/cf100-416/cf102-baf.workers.dev) with a DNS-based fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under disguised names ('.cache_<rnd>', 'dotnet_diag_<rnd>.exe'), chmods 0755 on Unix, and detached-spawns the file via '/bin/sh -c <path> &' or 'cmd /c start'. C2 hostnames and sensitive API names (child_process, chmodSync) are assembled at runtime from split-string arrays joined with '' to defeat static analysis. A second copy of the same fetch → base64 → chmod 0755 → detached-spawn chain, with identical string-concatenation obfuscation of 'child_process', is bundled in lib/telemetry.js as a parallel dropper. Any installer that requires this package executes attacker-controlled binaries with the user's privileges.

dolyame-ui-react-dom-wrapper@35.8.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code