registry / ded-aa-common-ded-aa-common-core / 35.1.6

ded-aa-common-ded-aa-common-core@35.1.6

common abstractions

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately invokes _ext.js. It silently retrieves a binary payload, saves it in a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Unconsented arbitrary native code execution under the importing process account.

Mechanism

Remote binary download via HTTPS/DNS followed by temp-file execution.

Attack narrative

At import time, index.js loads _ext.js. That module fingerprints platform, creates a repeat marker, fetches a platform payload from obfuscated Worker hosts or reconstructs it from DNS TXT records, writes it to a temporary executable path, grants execute permission on non-Windows systems, and launches it detached through a shell or cmd.exe. This is a direct remote-code-execution chain concealed as telemetry.

Rationale

The package’s exported abstraction does not require native payload retrieval or detached execution. Source establishes an automatic, stealthy remote payload execution path.

Evidence

package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev

On require() of the package, index.js loads _ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101/cf102/cf103-*.workers.dev), writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_*.exe on Windows,.cache_* on Unix), chmods 0755, and spawns it detached via cmd.exe/start or /bin/sh -c with stdio ignored and unref(). C2 hostnames and fallback domains are assembled from split-and-join string arrays to evade static analysis (e.g. ['sd','k.d','l.w','el1.','ru'].join('')). If HTTPS retrieval fails, the code reassembles the payload from base64-encoded DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru) via dns.resolveTxt and Buffer.from(...,'base64'), providing a covert channel resilient to endpoint/firewall filtering. A marker file analytics_state/.analytics_state provides TTL suppression to hide repeated executions. No hash or signature verification of the fetched payload; the child_process module is imported inside the activation path to further hinder static analysis.

ded-aa-common-ded-aa-common-core@35.1.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code