registry / cardsmobile-event-emitter / 35.2.8

cardsmobile-event-emitter@35.2.8

mobile SDK

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently launches a remote binary loader. It fetches or DNS-reconstructs a platform-specific payload, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js, unless an opt-out environment variable is set.

Impact

Arbitrary attacker-supplied native code executes with the importing process's privileges.

Mechanism

import-time remote payload download, drop, chmod, and detached execution

Attack narrative

A normal import of index.js requires _loader.js. Its start() function downloads a binary from attacker-controlled hosts or reconstructs it from DNS TXT records, stores it in a temp path, makes it executable on Unix, and starts it through /bin/sh or cmd.exe in a detached process.

Rationale

This is concrete import-time staged remote code execution unrelated to an event emitter; no user action or declared lifecycle hook is required.

Evidence

index.js_loader.jslib/telemetry.jspackage.json/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.de

cardsmobile-event-emitter@35.2.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code