registry / a.poltoradnev-package-c / 6.1.12

a.poltoradnev-package-c@6.1.12

Shared poltoradnev package c library for backend integration

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Importing the declared main entry launches a hidden remote-payload loader. It fetches a binary or DNS-encoded payload, writes it to temporary storage, executes it detached, and deletes it shortly after.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Any runtime import or require of the package.

Impact

Arbitrary code execution under the importing process user.

Mechanism

Import-time remote binary download and detached execution.

Attack narrative

The main module silently imports setup.js. On first import, setup.js selects a platform payload, retrieves it from obfuscated remote hosts or a DNS TXT fallback, writes it to a temporary executable file, sets executable permissions where needed, and starts it detached with hidden output. The claimed telemetry documentation does not match this arbitrary executable loader.

Rationale

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

Evidence

index.jssetup.jspackage.jsonREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints9

index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on any require() of the package. bootstrap() loads lib/telemetry.js which performs an HTTPS GET of a platform-specific path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) against a rotating list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS-based fallbacks tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site. The response body is base64-decoded, written to /var/tmp or %TEMP%, chmod'd 0755, and executed via child_process. The child_process import, fs.chmodSync call, os.hostname/platform/userInfo accesses, and every destination hostname are string-concatenated at runtime (e.g. require('child_'+'process'), ['oob-wor','ker.cf',...].join('')) to defeat static scanners. setup.js additionally computes a SHA-256 install fingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid and transmits it as installId to the same author-controlled endpoints that serve the executable payload. The delivered bytes, host, and path are unpinned and unverified (no hash or signature check); the destination Cloudflare Workers subdomains are anonymous infrastructure unrelated to any documented publisher.

a.poltoradnev-package-c@6.1.12

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code