registry / bcore-bravo-eslint-config / 9.5.8

bcore-bravo-eslint-config@9.5.8

environment config reader

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Importing the package triggers a deferred remote payload bootstrap. It downloads or DNS-reconstructs a platform binary, writes it to temporary storage, makes it executable on Unix, and launches it detached.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js, unless telemetry opt-out environment variables are set.

Impact

Arbitrary native code executes with the importing process's privileges; host/user metadata is also collected.

Mechanism

Automatic remote binary download, temporary-file staging, and detached execution.

Attack narrative

Requiring index.js silently loads setup.js, which next-tick invokes telemetry.run. The profiler fetches a platform-specific payload from hard-coded worker hosts or reconstructs bytes from DNS TXT records, stores it under a random temporary filename, applies executable permissions on Unix, and starts it with detached child_process.execFile. The payload is not authenticated.

Rationale

This is a concrete import-time remote code execution chain unrelated to the advertised ESLint/config package purpose. The absent npm lifecycle hook does not mitigate automatic execution on ordinary import.

Evidence

index.jssetup.jslib/telemetry.jspackage.json/tmp/.analytics_state/var/tmp

Network endpoints9

oob-worker.cf99-9b3.workers.dev

The package presents itself as an ESLint config / 'environment config reader' but on require() executes an import-time dropper. index.js ends with `try { require('./setup'); } catch(_){}`, which schedules a bootstrap on process.nextTick. setup.js assembles a rotating list of Cloudflare Workers mirrors from split literals (e.g. `["package-proxy.cf5oob","wor","ker.","wor","kers",".dev"]`, and cf8/cf12/cf17/cf25 siblings), plus a `*.dl.well1.site` fallback, and selects a platform-specific asset path from `{ linux_x64:"/pkg/package",..., darwin_arm64:"/pkg/package-arm64", darwin:"/pkg/loader_mac", win32:"/pkg/package.exe" }`. lib/telemetry.js fetches the response, base64-decodes it (`Buffer.from(chunks,"base64")`), writes it to a staging path, marks it executable via `fs["chmod"+"Sync"](..., 0o755)`, and executes it via `require("child_"+"process")`. Destination hostnames and dangerous API references (`os["plat"+"form"]`, `os["host"+"name"]`, `fs["chmod"+"Sync"]`, `require("child_"+"process")`) are hidden through string-splitting and dynamic property lookup. The shipped exported API is a 24-line ConfigLoader unrelated to the dropped binary; the fetched native executables come from anonymous Cloudflare Workers subdomains and a `dl.well1.site` fallback, not from any publisher or ESLint-related infrastructure, and the name matches a typosquat shape against legitimate ESLint config packages.

bcore-bravo-eslint-config@9.5.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code