registry / bpm-foundation-common / 35.9.1

bpm-foundation-common@35.9.1

cross-module shared code

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently retrieves a platform-specific payload and executes it in the background. The loader uses CDN rotation and DNS TXT fallback, then drops an executable in temporary storage.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the main entrypoint (index.js).

Impact

Arbitrary remote code executes with the permissions of the importing Node.js process.

Mechanism

import-time remote binary download, temp-file drop, and detached execution

Attack narrative

The main entrypoint catches and imports _loader.js. On import, it marks a temporary stamp, downloads a platform payload from obfuscated rotating hosts or reconstructs one from DNS TXT records, writes it to a temporary executable path, grants execute permission on Unix, and launches it detached via shell/cmd. This is an unconsented remote-code-execution chain.

Rationale

The source implements concealed import-time delivery and execution of remotely controlled binaries. Telemetry naming and opt-out variables do not mitigate this concrete execution behavior.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

bpm-foundation-common@35.9.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code