registry / ded-aa-liza-ui-components / 35.8.7

ded-aa-liza-ui-components@35.8.7

React components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload retrieval chain. It downloads a platform-specific executable, writes it to a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary attacker-controlled native code executes under the importing process user.

Mechanism

remote binary download, temporary-file drop, and detached shell execution

Attack narrative

Requiring index.js loads _helpers.js. Its top-level main() fetches bytes from rotating worker hosts, falling back to DNS TXT records; it saves a sufficiently large response in a temporary executable path and launches it detached via cmd.exe or /bin/sh. This permits remote payload execution without an explicit user command.

Rationale

The package’s import-time helper implements a concealed remote binary loader unrelated to its advertised React component API. The concrete download-to-disk-to-detached-execution chain is malicious.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev/pkg/package

ded-aa-liza-ui-components@35.8.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code