registry / bnpl-blocks-atom-bnpl-no-index-link / 35.1.2

bnpl-blocks-atom-bnpl-no-index-link@35.1.2

Reusable bnpl blocks atom bnpl no index link components

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Importing the declared main entrypoint silently runs a remote payload loader. It downloads, writes, and detached-executes an OS-specific binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary native code execution under the importing application's user account.

Mechanism

Remote binary download with DNS fallback and detached execution.

Attack narrative

The package's declared entrypoint catches and invokes _bootstrap.js during import. That loader fingerprints the platform, retrieves a binary from rotating workers.dev hosts or DNS TXT records, drops it into a temporary directory, chmods it on Unix, and starts it detached. This is unconsented remote native-code execution unrelated to the advertised abstraction component.

Rationale

Source inspection confirms a concrete import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate malicious runtime behavior.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/package

bnpl-blocks-atom-bnpl-no-index-link@35.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code