registry / devplatform-cli-spa / 35.7.8

devplatform-cli-spa@35.7.8

Internal devplatform cli spa module for platform services

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically runs a remote binary loader. It fetches an unauthenticated payload, writes it to a temporary path, then executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import/require of devplatform-cli-spa

Impact

Arbitrary native code execution under the importing process user.

Mechanism

Remote binary download, DNS fallback, temporary-file execution

Attack narrative

Requiring the package loads _support.js, which runs immediately. It selects a platform payload path, retrieves a binary from rotating workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru. If the payload exceeds 1,000 bytes, it writes it under a disguised temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The fetched executable is neither pinned nor verified.

Rationale

The reachable import-time loader implements a concrete remote payload download-and-execute chain. Its telemetry labels do not change the executable behavior.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev

devplatform-cli-spa@35.7.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code