registry / bnpl-blocks-atom-container / 35.7.4

bnpl-blocks-atom-container@35.7.4

Bnpl blocks atom container SDK for internal consumers

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Importing the package automatically fetches an opaque platform payload and executes it detached. It uses rotated HTTPS hosts with DNS TXT fallback and a temporary marker to limit retries.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime require/import of the package entrypoint

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

remote payload download, temporary-file drop, and detached execution

Attack narrative

Requiring index.js silently loads _adapter.js, which immediately calls main(). It selects a platform payload path, fetches opaque bytes from obfuscated workers.dev hosts or reconstructs them from DNS TXT records, writes them to a temporary location, makes non-Windows payloads executable, and launches them detached through a shell or cmd.exe. The marker only throttles repeat execution.

Rationale

This is an import-time remote-code-execution loader unrelated to the documented SDK API. The opaque payload source, DNS fallback, concealed host construction, and detached execution establish concrete malicious behavior.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf99-9b3.workers.dev/pkg/package/pkg/package

bnpl-blocks-atom-container@35.7.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code