registry / @ceeferenderer/fe-renderer-sdk / 99.9.9

@ceeferenderer/fe-renderer-sdk@99.9.9

Enterprise-grade utilities for production JavaScript applications with comprehensive validation, error handling, and cross-environment compatibility.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The package has confirmed install-time and import-time telemetry exfiltration over DNS. The behavior is hidden in obfuscated lib files and unrelated to the advertised frontend utility SDK.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install lifecycle or requiring the package entrypoint index.js

Impact

Leaks host and project/environment identifiers to attacker-controlled DNS infrastructure during install/import.

Mechanism

DNS exfiltration of username, hostname, cwd basename, and timestamp

Attack narrative

On install, npm runs node index.js. The entrypoint silently requires lib/core, which decodes hidden strings, reads local username, hostname, and current directory basename, concatenates them with a timestamp and oob.sl4x0.xyz, then calls dns.resolve4 on that constructed hostname. The same behavior also runs when consumers import the package.

Rationale

Source inspection confirms covert DNS exfiltration of host/project identifiers at install time and import time, implemented through obfuscated helper files and unrelated to package functionality. This is concrete malicious behavior, not a noisy static hint.

Evidence

package.jsonindex.jslib/core.jslib/b02e30.jslib/6ad264.js

Network endpoints1

oob.sl4x0.xyz

OSV Corroboration

Multiple evidences suggest malicious intent: code obfuscation, dynamic code execution, process access, install script, and suspicious email. --- ## Source: amazon-inspector (feee20bafab758bb648bbe425a100a13e6d21799552a2b5566fe6029faef6ce4) Package runs malicious code both at install time (package.json `install` script: `node index.js`) and at require time (`main: index.js`). index.js silently requires `./lib/core` inside a try/catch. lib/core.js, with the help of two obfuscated helper modules (lib/b02e30.js and lib/6ad264.js), builds the strings 'os', 'dns', and 'oob.sl4x0.xyz' from numeric character-code arrays via String.fromCharCode and loads built-in modules through `module.constructor._load(...)` to evade static inspection. It then assembles the subdomain `ceefe.<username>.<hostname>.<cwd_basename>.<unix_timestamp>.oob.sl4x0.xyz` and issues a `dns.resolve4()` lookup, exfiltrating the installer's OS username, hostname, and working-directory name to an attacker-controlled domain over DNS. The combination of auto-execution on install and require, character-code obfuscation of both the target domain and built-in module names, DNS (rather than HTTP) as the exfil channel, random-hex-named helper files, and silent try/catch swallowing of errors is an unambiguous credential-reconnaissance beacon.

@ceeferenderer/fe-renderer-sdk@99.9.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code