registry / bpm-foundation-oauth-client / 35.4.3

bpm-foundation-oauth-client@35.4.3

session management

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a background remote-payload downloader. It drops and executes an unverified platform binary while suppressing output and errors.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary code execution with the privileges of the importing process.

Mechanism

Remote binary download, temporary-file drop, chmod, and detached execution.

Attack narrative

The package entrypoint silently requires _support.js. That module fetches a platform-specific payload from hard-coded workers.dev hosts, with DNS TXT retrieval from hard-coded .ru domains as fallback, writes it under a temporary path, marks it executable on Unix, and starts it detached via /bin/sh or cmd.exe. No integrity verification or user action is required.

Rationale

This is concrete import-time remote code execution, not telemetry: an opaque remote binary is downloaded, dropped, and launched detached. The lack of lifecycle hooks does not mitigate the reachable entrypoint trigger.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_state

Network endpoints7

oob-worker.cf100-416.workers.dev/pkg/package

On require() of the package, _support.js selects a platform-specific payload path, downloads an opaque binary from one of three Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev), writes it under disguised names (.cache_<hex> in /tmp, dotnet_diag_<hex>.exe in %TEMP%), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If the HTTPS mirrors fail, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.<domain> and sequential N.<domain> subdomains under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenates and base64-decodes the responses into the same executable buffer, and runs it. The fetched bytes are executed with no signature or hash verification. Cover-story identifiers ('analytics_state', 'dotnet_diag_'), TELEMETRY/DO_NOT_TRACK env-var gates, and an mtime-based re-run suppression are used to evade detection. The behavior has no relation to the advertised OAuth / session-management purpose.

bpm-foundation-oauth-client@35.4.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code