registry / devplatform-jscodeshift-utils / 35.3.8

devplatform-jscodeshift-utils@35.3.8

helper methods

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the declared main entrypoint silently starts a remote payload downloader. It persists a short-lived stamp and executes the downloaded binary detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of devplatform-jscodeshift-utils.

Impact

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Mechanism

Remote binary download, temporary-file drop, and detached execution.

Attack narrative

The package's normal import path requires _bootstrap.js. Its asynchronous run routine fetches a platform-specific opaque payload from rotating worker hosts, or reconstructs one from attacker-controlled DNS TXT records, writes it to a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The telemetry naming and opt-out variables do not limit this behavior to telemetry data.

Rationale

This is concrete import-time remote payload execution, not a package-aligned utility feature. The absent install hook does not mitigate execution on ordinary use.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

/pkg/package

The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes `try { require('./_bootstrap'); } catch (_) {}` on module load, hiding the malicious side effect behind a swallowed exception. _bootstrap.js selects a platform-specific payload path, downloads bytes from one of three hardcoded Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru — writes the payload to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd /c start`. Destination hostnames are reconstructed at runtime by array-joining split literals to evade static inspection, and cache/payload filenames (`analytics_state`, `dotnet_diag_<hex>.exe`) are chosen to blend in with legitimate telemetry artifacts. An 80KB lib/telemetry.js is shipped but never referenced from index.js, consistent with cover-story padding. Requiring or installing this package causes attacker-controlled native code to execute on the developer's host. ## Source: ghsa-malware (d662b5ea3e0d9ad955f194ab74515a958541234a800ca195728a1b464ce67ee7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

devplatform-jscodeshift-utils@35.3.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code