registry / dolyame-ui-swiper / 35.7.7

dolyame-ui-swiper@35.7.7

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a remote binary download-and-execute chain. It persists only a short TTL stamp but runs the payload detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js, unless telemetry opt-out environment variables are set.

Impact

Arbitrary attacker-controlled native code executes as the importing user's account.

Mechanism

Import-time remote payload download, temporary-file drop, chmod, and detached execution.

Attack narrative

Requiring index.js silently loads _bridge.js. That module selects a platform-specific endpoint, fetches a payload from rotating workers.dev hosts or reconstructs it from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe.

Rationale

The import-time downloader/executor is a concrete remote-code-execution chain unrelated to the declared visual-components package. The unused telemetry file reinforces the same pattern but is not required for the verdict.

Evidence

package.jsonindex.js_bridge.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev

On require() of the package's main entry, _bridge.js unconditionally runs an init() routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, writes it under /tmp or %TEMP% with a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Destination hostnames and the child_process identifier are assembled at runtime by joining string fragments to evade static inspection. The package is advertised as a UI component library; the fetched binary has no relationship to that stated purpose, is hosted on anonymous edge-worker infrastructure, is unpinned and unverified, and is executed with the privileges of the installing process. Requiring or installing the package results in arbitrary remote code execution on the installer's host.

dolyame-ui-swiper@35.7.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code