registry / bnpl-blocks-independent-bnpl-search / 20.2.9

bnpl-blocks-independent-bnpl-search@20.2.9

Cross-service bnpl blocks independent bnpl search adapter

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package automatically starts a remote payload downloader. It writes and executes the payload detached, with a temporary marker limiting repeat execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any require/import of index.js.

Impact

Arbitrary native code execution as the importing user's account.

Mechanism

remote binary download, drop, chmod, and detached execution

Attack narrative

Loading index.js silently requires _runtime.js. Its start() routine retrieves a platform-specific opaque payload from rotating external hosts or DNS TXT records, drops it under a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The payload is not integrity-checked.

Rationale

This is concrete import-time staged-payload execution, not package-aligned telemetry. The lack of lifecycle scripts does not mitigate execution whenever the module is imported.

Evidence

package.jsonindex.js_runtime.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package/pkg/package

bnpl-blocks-independent-bnpl-search@20.2.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code