registry / cbp-exchange-government-cbp-exchange-government-core / 35.3.3

cbp-exchange-government-cbp-exchange-government-core@35.3.3

platform core

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically loads a covert downloader. It fetches a platform-specific binary, drops it to a temporary directory, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of the package entrypoint

Impact

Unconsented arbitrary native code execution as the importing user.

Mechanism

Import-time remote binary download and detached execution

Attack narrative

The package entrypoint suppresses errors while importing _loader.js. That module runs immediately, retrieves a binary over HTTPS or DNS TXT from obfuscated external infrastructure, writes it to a temporary path, marks it executable on Unix, and launches it through a detached shell or cmd.exe process.

Rationale

This is a concrete, automatic remote-payload execution chain on normal package import, not legitimate functionality for the declared minimal core package.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev/pkg/package

cbp-exchange-government-cbp-exchange-government-core@35.3.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code