registry / dolyame-ui-test / 35.2.5

dolyame-ui-test@35.2.5

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary bootstrapper. It fetches a payload from obfuscated hosts or DNS TXT records, writes it to a temporary path, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

require/import of index.js at application runtime

Impact

Arbitrary remote code execution with the privileges of the importing Node.js process.

Mechanism

remote binary download, temp-file drop, permission change, and detached shell execution

Attack narrative

A normal import reaches _platform.js, which rate-limits via a temp stamp, downloads an OS-specific executable from obfuscated Worker hosts or reconstructs one from DNS TXT records, writes it to a temporary directory, marks it executable on Unix, and launches it through a detached shell. This is unconsented remote payload execution unrelated to the declared visual-components package.

Rationale

The import-time bootstrap is a concrete, stealthy remote-code-execution chain. Absence of lifecycle hooks does not mitigate execution on ordinary package import.

Evidence

package.jsonindex.js_platform.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf103-070.workers.dev

index.js unconditionally requires./_platform on module load. _platform.js reconstructs attacker-controlled hostnames via string-splitting (Array.join) to fetch a platform-specific native binary from one of four Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev). On HTTPS failure it falls back to a DNS-TXT covert channel under wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reading a chunk count from c.<domain> and reassembling base64-encoded payload chunks from N.<domain> TXT records. The fetched binary is written to /tmp or the Windows temp directory under decoy names (dotnet_diag_*.exe,.cache_*,.analytics_state), chmod 0755, and spawned detached/unref'd via /bin/sh -c or cmd.exe /c start /b. A second, currently-unreferenced dropper in lib/telemetry.js duplicates the same fetch->chmod->spawn pattern behind a 'telemetry SDK' cover story, using require("child_"+"process") and fs["chmod"+"Sync"] to further obfuscate dangerous APIs. A UI package has no legitimate reason for this behavior; the destination obfuscation, DNS-TXT fallback, decoy filenames, and parallel staged dropper module together fingerprint a supply-chain attack delivering full-host remote code execution to any installer that requires the package.

dolyame-ui-test@35.2.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code