Importing the declared main entrypoint triggers hidden payload retrieval and execution. The downloaded binary is staged in a temp directory, launched detached, then removed.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Any Node.js import/require of index.js.
Impact
Arbitrary remote code executes under the importing process user.
Mechanism
Remote binary download, DNS fallback, detached execution, and cleanup.
Attack narrative
The package’s normal import path silently loads setup.js. That code contacts obfuscated external hosts for a platform-specific binary, with DNS TXT/base64 fallback, writes it to a temporary file, makes it executable on Unix, and starts it detached with output suppressed. It removes the staged binary shortly after launch and uses a temporary marker to limit repeats.
Rationale
This is a concrete remote-payload execution chain activated by importing the package, unrelated to the stated React-component purpose. No lifecycle hook is needed for the package to execute malware when consumed.
Evidence
package.jsonindex.jssetup.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints9
oob-worker.cf99-9b3.workers.dev