registry / dolyame-ui-themes / 35.6.3

dolyame-ui-themes@35.6.3

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload downloader. It persists a cooldown marker, drops a platform-specific executable, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import or require of dolyame-ui-themes.

Impact

Arbitrary attacker-supplied native code executes with the importing process user's privileges.

Mechanism

import-time remote payload download, drop, and detached execution

Attack narrative

A normal require of index.js catches and suppresses loader errors while loading _loader.js. The loader retrieves a platform payload from rotating HTTPS hosts or DNS TXT records, writes it to temporary storage, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe.

Rationale

This is a concrete import-time staged-payload execution chain unrelated to the package's stated UI themes purpose. The lack of lifecycle hooks does not mitigate execution on ordinary import.

Evidence

package.jsonindex.js_loader.jslib/telemetry.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev

dolyame-ui-themes ships a _loader.js that is required from the package main (index.js) at module load. The loader reconstructs C2 hostnames from split string arrays to hide them from static scanners, resolving to oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf103-070.workers.dev, with a covert-channel fallback that retrieves further endpoints from DNS TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The loader fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 755, and detached-spawns it through /bin/sh -c or cmd.exe. Dangerous APIs are loaded via runtime string concatenation (require("child_" + "process"), fs["chmod"+"Sync"]). A sibling module lib/telemetry.js is framed as an analytics SDK but duplicates the same dropper primitives (base64 chunk decoding, chmod 755, detached /bin/sh spawn) as a parallel loader path. The package name resembles the legitimate dolyame payment integration ecosystem, consistent with a typosquat/lookalike lure. Installing or requiring this package executes an opaque attacker-controlled binary on the installer's host.

dolyame-ui-themes@35.6.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code