registry / checkout-desktop-cashback / 35.4.6

checkout-desktop-cashback@35.4.6

Internal checkout desktop cashback module for platform services

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Requiring the package immediately starts an asynchronous bootstrap. It retrieves an opaque platform payload, writes it outside the package, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime import/require of index.js.

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

remote binary download, drop, chmod, and detached execution

Attack narrative

On import, index.js silently requires _vendor.js. Its bootstrap selects a platform endpoint, downloads an opaque payload from rotated workers.dev hosts or DNS TXT records, writes it to a temporary executable file, sets execute permission on Unix, and spawns it detached. Errors are suppressed, obscuring the behavior.

Rationale

This is concrete import-time staged-payload execution unrelated to the advertised cashback API. Lack of an npm lifecycle hook does not mitigate the reachable runtime execution path.

Evidence

index.js_vendor.jspackage.json/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf100-416.workers.dev/pkg/package/pkg/package

checkout-desktop-cashback@35.4.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code