Loading npm security reports…

claims-shared@35.7.1: Malicious npm security report (Block) | LPM Firewall

registry / claims-shared / 35.7.1

claims-shared@35.7.1

Pluggable claims shared interface

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately triggers a concealed downloader. It fetches a platform-specific binary, writes it under a temporary path, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of claims-shared.

Impact

Arbitrary remote code execution in the importing user's environment.

Mechanism

Remote binary download, temporary-file drop, and detached execution.

Attack narrative

On import, index.js loads _polyfill.js and suppresses errors. That module checks a temporary stamp, fetches a platform-specific payload from obfuscated worker hosts or reconstructs one from DNS TXT records, writes it to /var/tmp or the Windows temp directory, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe.

Rationale

This is concrete import-time remote payload execution, not normal telemetry. The unused-looking telemetry module independently contains a similar downloader design, reinforcing intent.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js

Network endpoints8

oob-worker.cf100-416.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf103-070.workers.dev

Source & flagged code

5 flagged · loading source

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

500L501: fork() { L502: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L500

•matchType = normalized_sha256 matchedPackage = checkout-base-test@35.9.3 matchedPath = lib/telemetry.js matchedIdentity = npm:Y2hlY2tvdXQtYmFzZS10ZXN0:35.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

_polyfill.jsView file

5Trigger-reachable chain: manifest.main -> index.js -> _polyfill.js L5: const fs = require("fs"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L44: const COOLDOWN = 22895; L45: const _l = (...a) => process.stderr.write(""); L46: ... L56: const isWin = _p("platform") === "win32"; L57: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L58: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L88: try { L89: require("dns").resolveTxt(d, (e, rr) => { L90: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_polyfill.jsView on unpkg · L5

Source & flagged code

5 flagged

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

500L501: fork() { L502: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L500

•matchType = normalized_sha256 matchedPackage = checkout-base-test@35.9.3 matchedPath = lib/telemetry.js matchedIdentity = npm:Y2hlY2tvdXQtYmFzZS10ZXN0:35.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

_polyfill.jsView file

5Trigger-reachable chain: manifest.main -> index.js -> _polyfill.js L5: const fs = require("fs"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L44: const COOLDOWN = 22895; L45: const _l = (...a) => process.stderr.write(""); L46: ... L56: const isWin = _p("platform") === "win32"; L57: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L58: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L88: try { L89: require("dns").resolveTxt(d, (e, rr) => { L90: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_polyfill.jsView on unpkg · L5