registry / arbocrate-sla-prober-arbocrate-sla-prober-core / 7.5.9

arbocrate-sla-prober-arbocrate-sla-prober-core@7.5.9

core runtime

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Importing the package triggers a hidden remote binary downloader and detached execution chain. It stores a short-lived marker and payload in system temporary locations.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Any application requiring the package.

Impact

Arbitrary native code executes with the privileges of the importing process.

Mechanism

import-time remote payload download, drop, and detached execution

Attack narrative

index.js silently requires setup.js during normal import. setup.js fetches an opaque platform-specific binary from obfuscated worker domains, with DNS TXT as fallback; it writes the bytes to a temporary executable, starts it detached with output discarded, then attempts deletion after five seconds. This is an unconsented remote-code-execution loader, not telemetry.

Rationale

The documented telemetry claim is inconsistent with the import-time download-and-execute behavior. No lifecycle hook is needed because ordinary package import activates the payload chain.

Evidence

package.jsonindex.jssetup.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints9

oob-worker.cf99-9b3.workers.dev/pkg/package

On require() of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev) and fallback hosts under well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe, writes the fetched bytes to a temp path, chmods 0755, and executes them via child_process. The sensitive APIs and destination hostnames are reconstructed at runtime through string concatenation and array-join tricks (require("child_"+"process"), os["plat"+"form"], fs["chmod"+"Sync"], hostnames assembled from split fragments) to evade static keyword scanners. Before contacting the remote hosts, setup.js hashes hostname, OS username, cwd, node version, and pid into an install fingerprint and passes it to the transport as an installId, letting the operator track each installer host receiving the payload. Destinations are anonymous Cloudflare Workers subdomains and a lookalike well1.site host, unrelated to any legitimate publisher infrastructure; fetched content is unversioned, unhashed, and unsigned.

arbocrate-sla-prober-arbocrate-sla-prober-core@7.5.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code