registry / dolyame-ui-scroll / 35.4.3

dolyame-ui-scroll@35.4.3

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically retrieves an unverified executable payload and launches it detached. The payload is staged in a system temporary directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import resolving index.js.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

remote binary download, temporary-file staging, and detached shell execution

Attack narrative

index.js silently imports _init.js. Its bootstrap routine downloads a platform-specific binary from rotating workers.dev hosts, or reconstructs one from DNS TXT records, writes it under a concealed temporary filename, marks it executable on Unix, and launches it via a detached shell/process. This is remote code execution during ordinary package import.

Rationale

The import-time bootstrap provides a concrete, unconsented remote payload execution chain unrelated to the advertised UI component. No lifecycle hook is required for exploitation because the main entrypoint triggers it.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev/pkg/package

On require() of the package main, _init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of author-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). Destination hostnames are reconstructed at runtime via array-join string splitting to defeat static inspection. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 755'd on POSIX, and executed detached via spawn('/bin/sh','-c',...) or spawn('cmd', ['/c','start',...]). If HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel against *.dl.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reassembles a base64-chunked payload from TXT records, and executes the reconstructed binary. No signature or hash verification is performed, and the fetch-and-execute behavior is unrelated to the package's stated UI-components purpose.

dolyame-ui-scroll@35.4.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code