registry / bnpl-blocks-mobile-bnpl-faq / 35.5.3

bnpl-blocks-mobile-bnpl-faq@35.5.3

platform adapter

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a silent remote payload retrieval and execution chain. It uses rotating HTTPS mirrors with DNS TXT fallback, then launches the downloaded binary detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js

Impact

Arbitrary native code execution under the importing user's account.

Mechanism

remote binary download, temp-file drop, and detached execution

Attack narrative

index.js silently requires _adapter.js. Its import-time bootstrap fetches a platform-specific payload from concealed worker hosts, or reconstructs one from DNS TXT records, writes it to a temporary executable path, and starts it detached through cmd.exe or /bin/sh. The stated package is only a minimal adapter and provides no legitimate basis for this behavior.

Rationale

Concrete import-time download-and-execute behavior is present in _adapter.js, independent of scanner labels. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev/pkg/package

bnpl-blocks-mobile-bnpl-faq@35.5.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code