registry / claims-fixtures-shared / 35.8.6

claims-fixtures-shared@35.8.6

Internal claims fixtures shared module for platform services

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically starts a background payload downloader. It retrieves, drops, marks executable, and detached-executes a platform-specific binary.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import of index.js

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

import-time remote binary download and detached execution

Attack narrative

Requiring the advertised package entrypoint suppresses errors while loading _helpers.js. That helper immediately downloads a platform-specific binary from rotating worker hosts or reconstructs one from DNS TXT records, writes it under a temporary filename, makes it executable on Unix, and launches it detached.

Rationale

This is a concrete import-time remote payload execution chain unrelated to the claimed fixture module. Absence of npm lifecycle scripts does not mitigate runtime compromise upon import.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

claims-fixtures-shared@35.8.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code