registry / boxy-bus-providers / 35.3.4

boxy-bus-providers@35.3.4

Lightweight boxy bus providers wrapper

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a concealed bootstrapper. It retrieves an unverified platform payload over HTTPS or DNS, writes it to temporary storage, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import/require of index.js

Impact

Arbitrary attacker-controlled native code execution as the importing user.

Mechanism

Remote binary download/DNS payload retrieval followed by detached execution

Attack narrative

Requiring index.js silently loads _compat.js. Its immediate bootstrap downloads an executable payload from rotating Workers hosts or reconstructs one from DNS TXT records, stores it under a misleading temporary filename, then runs it through a detached shell or cmd.exe process.

Rationale

This is a concrete import-time remote payload execution chain with obfuscated endpoints and no integrity verification. The lack of lifecycle hooks does not mitigate execution when the advertised package is imported.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev/pkg/package

boxy-bus-providers@35.3.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code