registry / accounts-timeline / 9.6.12

accounts-timeline@9.6.12

Accounts timeline SDK for internal consumers

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Importing the package silently runs setup.js. It retrieves an opaque platform payload, writes it to a temporary path, and executes it detached.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Any runtime require/import of accounts-timeline, unless an opt-out environment variable is set.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

remote binary download, drop, chmod, detached execution, and cleanup

Attack narrative

The public entrypoint imports setup.js at runtime. That module fetches an unverified opaque payload from obfuscated Worker-style hosts, or decodes one from DNS TXT records, stores it in a temporary directory, makes it executable on Unix, and starts it detached with output suppressed. It then attempts to remove the dropped file after five seconds. This is a concealed remote-code-execution chain unrelated to the stated SDK/telemetry function.

Rationale

Source confirms an import-triggered remote payload loader and detached execution chain. The absence of an npm lifecycle hook does not mitigate runtime compromise of package consumers.

Evidence

package.jsonindex.jssetup.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints9

/pkg/package

On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on OS/arch, setup.js selects one of /pkg/package, /pkg/package.exe, /pkg/loader_mac, or /pkg/package-arm64 and invokes lib/telemetry.js runtime.run(), which fetches bytes from hardcoded remote endpoints, base64-decodes them, writes them to /var/tmp (or %TEMP% on Windows), chmods 0755, and executes the resulting binary. The destination hostnames (package-proxy.cf5oob.workers.dev, package-proxy.cf8oob.workers.dev, package-proxy.cf12oob.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev, and tin/tina/ldr/win subdomains of dl.well1.site) are assembled at runtime from split-string arrays via.join(""), and sensitive API names (child_process, fs.chmodSync, os.hostname, os.platform) are reassembled from property-name concatenation to evade static analysis. setup.js additionally computes an installFingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid, sha256-hashes it, and passes it as installId in the fetch request, causing installer host identifiers to be transmitted to the same attacker-controlled endpoints. The package presents itself as an accounts SDK and has no legitimate need for a platform-branched binary fetch-decode-chmod-exec pipeline pointed at anonymous Cloudflare Workers subdomains.

accounts-timeline@9.6.12

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code