registry / claims-is-mobile-layout / 35.4.3

claims-is-mobile-layout@35.4.3

device integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically loads _vendor.js. It fetches an opaque native payload, stores it in a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import of claims-is-mobile-layout

Impact

Arbitrary attacker-supplied code executes under the importing user's account.

Mechanism

Remote binary download, DNS payload fallback, and detached execution

Attack narrative

At import time, index.js silently requires _vendor.js. Unless opt-out variables or a recent stamp suppress it, that module retrieves a platform-specific binary from rotating workers.dev hosts or reconstructs one from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and launches it detached via shell or cmd.exe.

Rationale

The package's advertised adapter entrypoint has no legitimate need to silently retrieve and execute opaque remote binaries. The executable chain is directly reachable on import and is concrete malicious behavior.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf102-ba.f.workers.devoob-worker.cf999-b3.workers.dev

claims-is-mobile-layout@35.4.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code