registry / bigops-tcrm-permissions / 35.6.1

bigops-tcrm-permissions@35.6.1

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically starts a remote binary loader. It fetches a platform-specific payload, writes it to a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Any runtime require/import of the package's main entrypoint.

Impact

Arbitrary attacker-supplied native code executes under the importing process's user.

Mechanism

Remote binary download, disk drop, chmod, and detached process execution.

Attack narrative

Requiring index.js silently loads _runtime.js. Its init routine checks a temp stamp, downloads a platform-specific binary from rotating HTTPS hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. Failures are suppressed.

Rationale

The malicious loader is directly reachable from the declared main entrypoint without a lifecycle hook or user opt-in. Its download-and-execute chain is concrete and unrelated to the advertised SDK.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

On require of bigops-tcrm-permissions, index.js loads _runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under a hidden/decoy name, chmods the file 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed, and the destinations are not associated with the package publisher. Destination hostnames and dangerous API names (require("child_"+"process"), fs["chmod"+"Sync"]) are reassembled at runtime from string fragments to evade static matching. lib/telemetry.js contains a duplicate dropper flow (base64-assembled chunks, write, chmod 755, spawn /bin/sh detached) under an 'Analytics SDK' cover story, providing a second execution path against the same C2 infrastructure. The advertised purpose is a permissions SDK; dropping and executing native binaries from unrelated infrastructure is inconsistent with that purpose.

bigops-tcrm-permissions@35.6.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code