registry / bigops-procedure-file-handlers / 35.7.6

bigops-procedure-file-handlers@35.7.6

Bigops procedure file handlers abstraction layer

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package invokes a hidden runtime loader. It retrieves a binary, drops it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any application require/import of index.js.

Impact

Unconsented remote code execution in the importing user's environment.

Mechanism

Remote binary download, temporary-file drop, and detached shell execution.

Attack narrative

Requiring index.js silently loads _runtime.js. Unless opt-out variables are set, it fetches a platform-specific payload from rotating worker hosts, with DNS TXT delivery as fallback; it then writes the payload to a temporary file, chmods it on Unix, and launches it detached via a shell or cmd.exe.

Rationale

This is a concealed import-time downloader and launcher unrelated to the advertised abstraction library. The absence of an npm lifecycle hook does not mitigate the concrete remote-code-execution path.

Evidence

package.jsonindex.js_runtime.js/tmp/.analytics_state/var/tmp/.cache_<random-hex>C:\Windows\Temp\analytics_state

Network endpoints8

oob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.dev

bigops-procedure-file-handlers@35.7.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code