registry / @baanx/blockchain-config / 9.9.11

@baanx/blockchain-config@9.9.11

Blockchain network, token and wallet configuration registry

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The install hook imports an obfuscated probe that performs a DNS lookup carrying local user, host, and working-directory data. No user command or opt-in gates this behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation executes node index.js.

Impact

The DNS operator at the encoded external domain can receive identifying machine and project metadata.

Mechanism

Importing the probe runs an immediate function that builds a DNS name from local environment values and resolves it through DNS.

Attack narrative

During installation, the package entrypoint initializes runtime support. Its probe is imported through that chain and immediately collects the operating-system username, hostname, current working-directory leaf, and time. It encodes those values into a DNS query sent to an obfuscated external domain. The use of an automatic install hook, concealed module loading, and an unrelated DNS endpoint makes this covert data exfiltration.

AI rationale

This is an active install-time DNS exfiltration path, not a configuration registry function. The encoded implementation and external endpoint support malicious intent.

Evidence

package.jsonindex.jsruntime/index.jsruntime/support/telemetry/probe/impl.jsruntime/support/telemetry/probe/e9c3a6.jsruntime/support/telemetry/probe/f0d4b7.js

Network endpoints1

oob.algamil7x.xyz

The package runs a bootstrap from both its install lifecycle script (`node index.js`) and its main module that invokes an obfuscated probe. The probe reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, concatenates them with a static tag (`bxcfg`) and a timestamp, and performs a `dns.resolve4` lookup against `<tag>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz`, exfiltrating installer identity over DNS to a non-first-party domain unrelated to the claimed baanx publisher. The exfil host and the `os`/`dns`/`userInfo`/`hostname`/`cwd`/`resolve4` API references are hidden in `String.fromCharCode`/hex-decoded byte arrays in `probe/impl.js` and sibling files `e9c3a6.js` / `f0d4b7.js`, and the `os` and `dns` modules are loaded through `module.constructor._load` with decoded name arrays to defeat static analysis. Behavior fires automatically on `npm install` and on `require('@baanx/blockchain-config')`. ## Source: ghsa-malware (6efa71410686d3ace79a501e2afa27505312aab915fb79429b312f9456d272b0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@baanx/blockchain-config@9.9.11

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code