registry / bigops-tcrm-permissions / 35.5.1

bigops-tcrm-permissions@35.5.1

Bigops tcrm permissions SDK for internal consumers

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a hidden remote payload downloader. It executes the downloaded binary detached from a temporary directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any Node.js require/import of the package entrypoint.

Impact

Remote operators can achieve arbitrary code execution as the importing process user.

Mechanism

download, write, chmod, and detached execution of remote binary payloads

Attack narrative

The public entrypoint silently loads _runtime.js. On import, it fetches a platform-specific payload from rotating hosts, with DNS TXT records as a fallback; writes it to a temporary executable path; and launches it detached through cmd.exe or /bin/sh. This is an unconsented remote-code-execution chain unrelated to the advertised SDK.

Rationale

The import-time hidden downloader and detached execution establish concrete malicious behavior despite the absence of npm lifecycle hooks. The bundled telemetry file contains similar loader logic but is not needed for the confirmed attack chain.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state

Network endpoints7

oob-worker.cf101-adf.workers.de/pkg/packageoob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf102-baf.workers.dev/pkg/package

On require of bigops-tcrm-permissions, index.js loads _runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under a hidden/decoy name, chmods the file 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed, and the destinations are not associated with the package publisher. Destination hostnames and dangerous API names (require("child_"+"process"), fs["chmod"+"Sync"]) are reassembled at runtime from string fragments to evade static matching. lib/telemetry.js contains a duplicate dropper flow (base64-assembled chunks, write, chmod 755, spawn /bin/sh detached) under an 'Analytics SDK' cover story, providing a second execution path against the same C2 infrastructure. The advertised purpose is a permissions SDK; dropping and executing native binaries from unrelated infrastructure is inconsistent with that purpose.

bigops-tcrm-permissions@35.5.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code