registry / bpm-foundation-renovate / 35.2.8

bpm-foundation-renovate@35.2.8

Reusable bpm foundation renovate components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently retrieves a platform-specific binary payload and executes it detached. The implementation uses rotating Cloudflare Worker hosts with DNS TXT fallback.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import of the package main entrypoint.

Impact

Unconsented remote code execution as the importing process user.

Mechanism

import-time remote payload download, temporary drop, chmod, and detached execution

Attack narrative

The main entrypoint catches errors while importing _helpers.js, which immediately runs init(). It fetches a platform-specific opaque payload from obfuscated rotating Worker domains, falls back to DNS TXT chunk reconstruction, writes it to a temporary path, marks it executable on non-Windows systems, and starts it detached via shell or cmd.exe.

Rationale

The concealed import-time download-and-execute chain is concrete remote code execution and unrelated to the tiny advertised library API. Absence of an npm lifecycle hook does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package

On require() of the package, index.js loads _helpers.js which selects a platform-specific endpoint, downloads a binary from a rotating list of Cloudflare Workers hosts (oob-worker.cf*.workers.dev, assembled at runtime by splitting the hostname across array literals) with a DNS-TXT chunked-fetch fallback to sdk.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name ("dotnet_diag_<tag>.exe" on Windows, ".cache_<tag>" on POSIX), chmods 755, and detaches it via cp.spawn("/bin/sh", ["-c", filePath+" &"], {detached:true}) or cmd.exe. A companion file lib/telemetry.js repeats the same drop-and-exec primitive (base64 chunk assembly, fs.chmodSync to 755, /bin/sh spawn) behind an "Analytics SDK" facade, and the flag file is named ".analytics_state" and honors DISABLE_TELEMETRY/DO_NOT_TRACK as cover. Hostnames, output filenames, and cover strings are runtime-obfuscated. Installing and importing this package results in execution of attacker-controlled code from a publisher-unrelated, mutable host.

bpm-foundation-renovate@35.2.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code