registry / boxy-test-block-fixture / 35.5.5

boxy-test-block-fixture@35.5.5

testing utilities

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload downloader. It executes the downloaded binary detached and suppresses output.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary code execution as the application user.

Mechanism

Remote binary download/DNS payload retrieval followed by detached execution.

Attack narrative

The public entry point catches and suppresses errors while importing _init.js. That module contacts hard-coded workers.dev hosts for a platform-specific binary, or reconstructs one from DNS TXT records under wel1.ru. It writes the response into a temporary executable file and launches it detached via cmd.exe or /bin/sh, without a cryptographic integrity check.

Rationale

This is an unconsented import-time staged payload chain culminating in arbitrary native code execution. The harmless-looking public API and unused telemetry source do not mitigate that concrete behavior.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf10-1-adf.workers.dev

boxy-test-block-fixture@35.5.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code