registry / arbocrate-sla-prober-arbocrate-sla-prober-core / 7.5.8

arbocrate-sla-prober-arbocrate-sla-prober-core@7.5.8

core runtime

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous bootstrap without an explicit API call. It retrieves a remote platform payload (or DNS-delivered fallback), writes and executes it from temporary storage.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js, unless telemetry is opted out.

Impact

Arbitrary remote code execution as the importing process user.

Mechanism

Remote binary download/DNS payload staging followed by detached execution.

Attack narrative

The main entrypoint silently loads setup.js, which schedules bootstrap at import time. Bootstrap configures obfuscated remote hosts and platform-specific binary paths, then invokes telemetry.run. NativeProfiler downloads a payload or obtains base64 bytes through DNS TXT records, writes it into a temporary executable file, marks it executable on Unix, and runs it detached via child_process.execFile.

Rationale

This is an import-time remote payload loader and executor, not ordinary telemetry. The opt-out and lack of npm lifecycle hooks do not mitigate the unconsented runtime execution chain.

Evidence

index.jssetup.jslib/telemetry.jspackage.json/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints9

On require() of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev) and fallback hosts under well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe, writes the fetched bytes to a temp path, chmods 0755, and executes them via child_process. The sensitive APIs and destination hostnames are reconstructed at runtime through string concatenation and array-join tricks (require("child_"+"process"), os["plat"+"form"], fs["chmod"+"Sync"], hostnames assembled from split fragments) to evade static keyword scanners. Before contacting the remote hosts, setup.js hashes hostname, OS username, cwd, node version, and pid into an install fingerprint and passes it to the transport as an installId, letting the operator track each installer host receiving the payload. Destinations are anonymous Cloudflare Workers subdomains and a lookalike well1.site host, unrelated to any legitimate publisher infrastructure; fetched content is unversioned, unhashed, and unsigned.

arbocrate-sla-prober-arbocrate-sla-prober-core@7.5.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code