registry / dolyame-ui-text / 35.7.4

dolyame-ui-text@35.7.4

React components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently retrieves and executes an unverified native payload. It uses rotating HTTPS hosts and DNS TXT records as a fallback, then drops a temporary executable.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package's declared main entrypoint.

Impact

Arbitrary remote code execution as the importing user's account.

Mechanism

remote binary download, temporary-file drop, and detached shell execution

Attack narrative

The package main imports _init.js. That module fetches a platform-specific binary from obfuscated workers.dev hosts or reconstructs it from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The same download-and-execute pattern also appears in the unused telemetry module.

Rationale

This is a concrete import-time remote payload execution chain unrelated to the stated React-components purpose. The absence of lifecycle hooks does not mitigate execution on normal package use.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>Windows Temp/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev/pkg/package

The package is published under a name suggesting a React UI text component, but its main entry (index.js) require()s./_init on module load, which acts as a binary dropper. _init.js reconstructs C2 hostnames at runtime from string-split arrays (resolving to oob-worker.cf*.workers.dev and *.dl.wel1.ru), downloads a platform-specific payload over HTTPS with a DNS-TXT base64 fallback channel (chunk-count read from c.<domain>, chunks reassembled from N.<domain>), writes the payload to /tmp (Unix) or %TEMP% (Windows) under decoy names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. A second dropper implementation in lib/telemetry.js, cover-labeled as an 'Analytics SDK', base64-decodes an embedded payload buffer, uses bracket-property obfuscation to hide chmodSync, and spawns the dropped file via /bin/sh -c. No published functionality relates to a UI text component; the delivered code, its obfuscation, and its execution path have no benign explanation.

dolyame-ui-text@35.7.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code