registry / devplatform-sdk / 35.6.1

devplatform-sdk@35.6.1

Lightweight devplatform sdk wrapper

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently triggers a remote binary downloader. It caches a timestamp, writes the payload to a temp directory, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import of index.js, without an explicit SDK setup call.

Impact

Arbitrary attacker-controlled native code executes as the importing process user.

Mechanism

Remote binary download, DNS fallback, temp-file execution.

Attack narrative

A normal require of index.js loads _polyfill.js. Its top-level start function fetches a platform-specific binary from obfuscated workers.dev hosts, or reconstructs one from DNS TXT records at fallback domains. It writes the bytes into a temp file, marks Unix payloads executable, and starts them detached through /bin/sh or cmd.exe. No integrity or signature verification is performed.

Rationale

This is a concrete, automatic remote-code-execution chain on package import, unrelated to the advertised lightweight SDK interface.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev/pkg/package

On require('devplatform-sdk'), index.js loads _polyfill.js which auto-invokes start(): it selects a per-OS payload path, fetches a binary from string-concatenated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it under /var/tmp or %TEMP% with a camouflaged name (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmods 0o755, and detached-spawns it via /bin/sh -c or cmd /c start /b. Evasion features accompany the drop-and-run: hostnames assembled from split fragments via.join(''), the dropped binary renamed to look like a system cache/diagnostic file, a mtime-based stamp file at /tmp/.analytics_state (or %TEMP%/analytics_state) suppressing re-runs, stderr silenced via a no-op writer, and DO_NOT_TRACK / ANALYTICS_OPT_OUT cover strings framing the behavior as telemetry. The package advertises itself as a lightweight SDK wrapper; the load-time behavior is a binary dropper delivering arbitrary attacker-controlled native code to the installer.

devplatform-sdk@35.6.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code