registry / bigops-products-investment / 35.3.1

bigops-products-investment@35.3.1

Bigops products investment SDK for internal consumers

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically invokes a concealed remote binary loader. It fetches or reconstructs an unverified platform payload, writes it to a temporary path, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary attacker-controlled code executes with the importing process's privileges.

Mechanism

remote payload download/DNS retrieval followed by detached native execution

Attack narrative

On package import, index.js silently requires _vendor.js. That module identifies the platform, downloads a binary from rotating workers.dev hosts or reconstructs one from DNS TXT records, writes it under a benign temporary filename, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is an unconsented staged payload execution chain.

Rationale

Source directly establishes import-time retrieval and execution of an unverified remote native payload; no legitimate SDK behavior requires this concealed loader.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev/pkg/package

bigops-products-investment@35.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code