registry / devplatform-s3-resources / 35.5.1

devplatform-s3-resources@35.5.1

Devplatform s3 resources provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous remote-binary loader. It stores and detached-executes a downloaded payload without user consent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of devplatform-s3-resources.

Impact

Arbitrary native code execution under the importing process account.

Mechanism

Remote binary download/DNS staging followed by temp-file execution.

Attack narrative

A normal require of index.js silently imports _compat.js. Unless opt-out variables or a recent stamp suppress it, that module retrieves a platform-specific binary from rotating workers.dev hosts or DNS TXT records, writes it under a temporary filename, makes it executable on Unix, and launches it detached via shell/cmd. The payload is neither bundled nor verified.

Rationale

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate arbitrary code execution on package import.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf100-416.workers.devoob-worker.cf103-070.workers.devoob-worker.cf102-baf.workers.dev

On load, index.js unconditionally requires./_compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070.workers.dev, cf102-baf.workers.dev), downloads the binary over HTTPS with a DNS-TXT covert-channel fallback that reassembles base64 chunks from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes it to /var/tmp or %TEMP% under masquerading names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b with stdio ignored and windowsHide set. A stamp file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a ~5.9h MAX_AGE dedupes re-executions across sessions. Endpoint hostnames are constructed by joining split string literals to evade static scanners, and CI opt-out checks are present to reduce detection in build environments. The package name resembles legitimate S3 tooling but the shipped code is a second-stage loader, not an S3 resource library.

devplatform-s3-resources@35.5.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code