registry / devplatform-nx-spa / 35.8.7

devplatform-nx-spa@35.8.7

Reusable devplatform nx spa components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a remote binary downloader and executor. It persists only a short-lived timestamp marker and payload file in temp directories.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import/require of devplatform-nx-spa

Impact

Arbitrary remote code execution in the importing user's context.

Mechanism

downloaded platform payload written to temp storage and detached-executed

Attack narrative

Requiring index.js immediately loads _support.js. That module fetches an OS-specific payload from obfuscated workers.dev mirrors, falling back to DNS TXT chunks from wel1.ru domains. It writes the response to a temporary executable path, marks it executable on Unix, and launches it detached via /bin/sh or cmd.exe.

Rationale

Source confirms an import-time remote payload download-and-execute chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate runtime RCE on package import.

Evidence

package.jsonindex.js_support.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf100-416.workers.devoob-worker.cf101-adf.workers.dev

devplatform-nx-spa@35.8.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code