registry / a.poltoradnev-package-c / 33.9.5

a.poltoradnev-package-c@33.9.5

Shared poltoradnev package c library for backend integration

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package silently triggers a remote binary download and detached execution. The payload is cached in temporary storage and can also be delivered through DNS TXT records.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Any runtime require/import of the package.

Impact

Arbitrary native code execution as the importing process user.

Mechanism

Remote payload download, temporary-file drop, chmod, and detached shell execution.

Attack narrative

At import time, index.js loads _polyfill.js. It selects an OS-specific endpoint, downloads a payload from obfuscated hosts or decodes it from DNS TXT records, saves it under a misleading temporary filename, makes it executable on Unix, and starts it detached through a shell or cmd.exe.

Rationale

This is a concrete import-time remote code execution chain with stealthy payload delivery and execution. It is not required for the documented library API.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev

index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on any require() of the package. bootstrap() loads lib/telemetry.js which performs an HTTPS GET of a platform-specific path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) against a rotating list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS-based fallbacks tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site. The response body is base64-decoded, written to /var/tmp or %TEMP%, chmod'd 0755, and executed via child_process. The child_process import, fs.chmodSync call, os.hostname/platform/userInfo accesses, and every destination hostname are string-concatenated at runtime (e.g. require('child_'+'process'), ['oob-wor','ker.cf',...].join('')) to defeat static scanners. setup.js additionally computes a SHA-256 install fingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid and transmits it as installId to the same author-controlled endpoints that serve the executable payload. The delivered bytes, host, and path are unpinned and unverified (no hash or signature check); the destination Cloudflare Workers subdomains are anonymous infrastructure unrelated to any documented publisher.

a.poltoradnev-package-c@33.9.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code