registry / checkout-legal-logic / 35.3.7

checkout-legal-logic@35.3.7

structured logging

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently retrieves an opaque native payload and executes it detached. It uses HTTPS mirrors with DNS-TXT payload fallback and a short cooldown stamp.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary attacker-controlled code executes with the importing process user's privileges.

Mechanism

import-time remote binary download, staging, permission change, and detached execution

Attack narrative

index.js hides an import of _support.js behind a swallowed error. That module immediately downloads a platform-specific payload from obfuscated mirror hosts, or rebuilds one from DNS TXT records, stores it in a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe.

Rationale

This is concrete, unconsented import-time remote code execution unrelated to the advertised logging middleware. The DNS fallback and obfuscated endpoints further establish a staged malware delivery chain.

Evidence

package.jsonindex.js_support.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

checkout-legal-logic@35.3.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code