registry / devplatform-select-fields / 35.2.6

devplatform-select-fields@35.2.6

Devplatform select fields runtime support module

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently executes a downloader. It retrieves an opaque binary, drops it to a temporary directory, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of the package entrypoint

Impact

Unconsented arbitrary native code execution with the importing user's privileges.

Mechanism

import-time remote binary download, drop, and detached execution

Attack narrative

The exported module is a minimal facade, but index.js silently loads _shim.js. On import, the shim fingerprints the platform, requests a platform-specific binary from obfuscated Workers hosts, then falls back to DNS TXT records from .ru domains. It writes the received bytes to a temporary executable path, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The telemetry source contains the same remote-extension pattern but is not needed for the reachable attack chain.

Rationale

This is a concrete import-time staged payload execution chain, unrelated to the stated select-fields functionality. The lack of an npm lifecycle hook does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf102-baf.workers.dev/pkg/package

devplatform-select-fields@35.2.6 executes a binary dropper on any require() of the package. index.js loads _shim.js, which reconstructs C2 hostnames from split string fragments (Cloudflare Workers hosts of the form oob-worker.cf*-*.workers.dev, plus *.dl.wel1.ru), downloads a platform-specific payload over HTTPS, and falls back to a covert DNS TXT channel (reads a count from c.<domain> and reassembles a base64 payload from numbered TXT records). The payload is written to /var/tmp or %TEMP% under cover-story names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod 0755'd, and spawned detached via spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...). No hash or signature verification is performed. A setup() gate honors DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and writes an.analytics_state cool-down stamp (22583s) to suppress re-execution, framing the dropper as telemetry. Hostname string-splitting and the DNS-TXT reassembly path are anti-analysis measures. The package name resembles unrelated legitimate packages but the shipped code performs no advertised functionality.

devplatform-select-fields@35.2.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code