registry / devplatform-cli-contracts / 35.7.3

devplatform-cli-contracts@35.7.3

Shared devplatform cli contracts library for backend integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately loads _compat.js. It retrieves a binary payload from remote HTTPS/DNS endpoints, drops it to temporary storage, marks it executable, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

remote binary download, drop, and detached execution

Attack narrative

At import time, index.js silently requires _compat.js. That module uses HTTPS hosts and DNS TXT records to acquire a platform-specific payload, writes it to a temporary path, sets executable permissions on non-Windows systems, and starts it via a detached shell or cmd.exe process. The marker file only throttles repeat execution and does not provide user consent or verification.

Rationale

This is an import-triggered remote payload execution chain with no integrity validation or user-invoked action. The absence of lifecycle hooks does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_compat.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf100-416.workers.devoob-worker.cf102-baf.workers.dev

devplatform-cli-contracts@35.7.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code