bnpl-core@35.8.2: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing bnpl-core silently starts a remote payload downloader. A downloaded binary is written to temporary storage and executed detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary attacker-controlled native code can execute with the importing process's user privileges.

Mechanism

Remote binary download, temporary-file staging, and detached shell execution.

Attack narrative

The published entrypoint catches and suppresses errors while requiring setup.js. setup.js immediately contacts rotating remote hosts or DNS TXT endpoints, persists a lock marker, saves any sufficiently large response as an executable temporary file, and starts it detached via cmd.exe or /bin/sh. This is an import-time remote-code-execution chain with no user opt-in.

Rationale

The behavior is reachable on ordinary import, uses obfuscated endpoint construction and DNS fallback, and executes unverified remote bytes. The absence of npm lifecycle hooks does not mitigate this runtime RCE chain.

Evidence

index.jssetup.jslib/telemetry.jspackage.jsonREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>TEMP\analytics_stateTEMP\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.devoob-worker.cf100-416.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.dev

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports ./setup on every package import.
setup.js fetches platform binaries from four worker hosts or DNS TXT records.
setup.js writes the payload to /var/tmp or TEMP, marks it executable, and launches it detached.
lib/telemetry.js contains a second configurable downloader/launcher with the same behavior.

Evidence against

package.json has no lifecycle scripts.
No credential harvesting or exfiltration was found in the inspected entrypoint chain.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.5 KB of source

Source & flagged code

5 flagged

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

490L491: fork() { L492: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L490

•matchType = normalized_sha256 matchedPackage = bigops-timers@35.9.5 matchedPath = lib/telemetry.js matchedIdentity = npm:Ymlnb3BzLXRpbWVycw:35.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

setup.jsView file

6Trigger-reachable chain: manifest.main -> index.js -> setup.js L6: const fs = require("fs"); L7: const https = require("https"); L8: ... L44: const TTL = 23354; L45: const _l = (...a) => process.stderr.write(""); L46: ... L55: const isWin = _p("platform") === "win32"; L56: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L57: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

setup.jsView on unpkg · L6

Source & flagged code

5 flagged · loading source

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

490L491: fork() { L492: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L490

•matchType = normalized_sha256 matchedPackage = bigops-timers@35.9.5 matchedPath = lib/telemetry.js matchedIdentity = npm:Ymlnb3BzLXRpbWVycw:35.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Findings

2 Critical2 High2 Medium2 Low

CriticalDownload Executelib/telemetry.js

CriticalTrigger Reachable Dangerous Capabilitysetup.js

HighChild Processlib/telemetry.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowWeak Cryptolib/telemetry.js

LowFilesystem