registry / dolyame-ui-textarea / 35.3.4

dolyame-ui-textarea@35.3.4

UI toolkit

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the declared main entrypoint triggers a hidden remote binary loader. It retrieves, drops, and detached-executes an unsigned platform-specific payload.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any application requiring/importing dolyame-ui-textarea.

Impact

Arbitrary native code execution in the importing user's context.

Mechanism

import-time remote binary download, drop, chmod, and detached execution

Attack narrative

The public entrypoint silently requires _loader.js. On import, it downloads a platform payload from rotating hard-coded hosts, with DNS TXT delivery as fallback, writes it to a temporary path, makes non-Windows payloads executable, and launches it detached through /bin/sh or cmd.exe. This is concrete remote code execution unrelated to the stated UI component.

Rationale

This package has a reachable import-time unsigned remote-payload execution chain. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>/var/tmp/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf100-416.workers.devoob-worker.cf103-070.workers.dev

The package's main entry unconditionally requires./_loader.js on load. _loader.js assembles mirror hostnames from split string arrays to build a set of *.workers.dev endpoints (e.g. oob-worker.cf10x-*.workers.dev), fetches a platform-specific binary over https.get, and falls back to base64-chunked DNS TXT records under *.dl.wel1.ru subdomains when the HTTP mirrors are unavailable. The fetched bytes are written to /var/tmp or %TEMP% under masquerade filenames (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). Environment variables named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and a cache filename.analytics_state disguise the dropper as telemetry. A second variant of the same dropper (base64 chunk assembly, chmod 0755 via dynamic property name fs['chmod'+'Sync'], detached /bin/sh spawn) is bundled in lib/telemetry.js under an 'analytics SDK' cover story. The package name resembles a UI component library but ships no textarea functionality; its only on-load behavior is the drop-and-execute chain.

dolyame-ui-textarea@35.3.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code