Loading npm security reports…

book-collect@35.8.2: Malicious npm security report (Block) | LPM Firewall

registry / book-collect / 35.8.2

book-collect@35.8.2

Reusable book collect components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing book-collect immediately initiates a remote payload loader. It fetches a platform-specific binary, drops it into a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of book-collect.

Impact

Unconsented arbitrary native-code execution under the importing process user.

Mechanism

Remote binary download with DNS fallback, temporary-file drop, and detached execution.

Attack narrative

Requiring the package silently loads _loader.js. The loader selects a platform payload, downloads it from rotating obfuscated hosts or reconstructs it from DNS TXT records, writes it to a temporary path, changes permissions on Unix, and starts it detached. The payload is neither authenticated nor tied to the advertised book-component functionality.

Rationale

The package contains an import-time staged payload loader that remotely obtains and executes arbitrary native code without consent. This is concrete malicious behavior, not telemetry.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.dev/pkg/package

Source & flagged code

4 flagged · loading source

_loader.jsView file

3const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L45: const STAMP_TTL = 21022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_loader.jsView on unpkg · L3

3Trigger-reachable chain: manifest.main -> index.js -> _loader.js L3: const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L45: const STAMP_TTL = 21022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_loader.jsView on unpkg · L3

122try { L123: const cp = require("child_process"); L124: if (isWin) {

High

Child Process

Package source references child process execution.

_loader.jsView on unpkg · L122

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = pfa-errors@20.4.9 matchedPath = lib/telemetry.js matchedIdentity = npm:cGZhLWVycm9ycw:20.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged

_loader.jsView file

3const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L45: const STAMP_TTL = 21022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_loader.jsView on unpkg · L3

3Trigger-reachable chain: manifest.main -> index.js -> _loader.js L3: const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L45: const STAMP_TTL = 21022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_loader.jsView on unpkg · L3

122try { L123: const cp = require("child_process"); L124: if (isWin) {

High

Child Process

Package source references child process execution.

_loader.jsView on unpkg · L122

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = pfa-errors@20.4.9 matchedPath = lib/telemetry.js matchedIdentity = npm:cGZhLWVycm9ycw:20.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg