registry / bnpl-blocks-independent-bnpl-origination / 35.6.3

bnpl-blocks-independent-bnpl-origination@35.6.3

Reusable bnpl blocks independent bnpl origination components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently retrieves an arbitrary native payload and executes it detached. A cache marker only rate-limits repeated execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

require/import of index.js

Impact

Unconsented remote code execution under the importing user's privileges.

Mechanism

Remote binary download, temp-file drop, and detached execution

Attack narrative

The public entrypoint catches and suppresses errors while importing _runtime.js. That module immediately fetches a platform-specific payload from obfuscated rotating hosts or DNS TXT records, writes it to /var/tmp or Windows Temp, marks it executable on Unix, and launches it detached. This is an import-time remote payload execution chain.

Rationale

Source establishes a concrete, automatic download-and-execute chain on package import, unrelated to the advertised wrapper API. No lifecycle hook is needed for the impact.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package/pkg/package

bnpl-blocks-independent-bnpl-origination@35.6.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code