registry / devplatform-s3-uploader / 35.4.4

devplatform-s3-uploader@35.4.4

Lightweight devplatform s3 uploader wrapper

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a remote binary fetch and execution chain. It uses a temp marker only to limit repeat execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the main entrypoint.

Impact

Arbitrary native code can execute with the importing process's privileges.

Mechanism

Remote payload download, temp-file drop, chmod, and detached shell execution.

Attack narrative

The main entrypoint silently requires _helpers.js. Its immediately invoked start() selects a platform payload, downloads it from obfuscated worker hosts or DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is an import-time remote-code-execution chain, not required uploader functionality.

Rationale

Concrete source shows unconsented import-time download-and-execute behavior with obfuscated endpoints and no legitimate uploader implementation. Absence of lifecycle scripts does not mitigate the reachable main-entrypoint trigger.

Evidence

index.js_helpers.jspackage.jsonlib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev

On require() of the package, index.js loads _helpers.js which unconditionally runs a start() routine that selects a platform-specific asset path, fetches an opaque native binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under a cover-story name (e.g. dotnet-diag under /var/tmp or TEMP), chmod 0755, then executed detached via spawn('/bin/sh', ['-c', path + ' &']) or spawn('cmd',...) on Windows. No hash or signature verification. Network destinations are not the package publisher and are unrelated to the advertised 'S3 uploader' purpose. Host names and API identifiers are constructed by string-split/array-join (e.g. ['oob-worker.cf100-416.workers.','de','v'].join(''), require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis. A secondary module lib/telemetry.js, presented as an 'analytics SDK', ships parallel dropper primitives (base64 chunk reassembly, bracket-obfuscated chmod to 0755, cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true})) — co-shipped fallback attack infrastructure.

devplatform-s3-uploader@35.4.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code