registry / devplatform-spa-di / 35.5.8

devplatform-spa-di@35.5.8

Reusable devplatform spa di components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a hidden downloader. It retrieves a platform-specific executable or DNS-encoded payload, writes it to a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of devplatform-spa-di

Impact

Remote code execution in the importing user's process context.

Mechanism

import-time remote payload download, staging, and detached execution

Attack narrative

On ordinary package import, index.js suppresses errors while loading _polyfill.js. That module selects an OS payload endpoint, fetches binary data from obfuscated workers.dev hosts or reconstructs it through DNS TXT records, writes it under an innocuous temporary filename, marks it executable on Unix, and starts it detached via /bin/sh or cmd.exe. The code includes a timestamp marker only to limit repeat execution, not to obtain consent.

Rationale

This is a concrete, automatically reachable remote binary staging and execution chain concealed behind an unrelated DI package API. The absence of lifecycle scripts does not mitigate import-time execution.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>TEMP\analytics_stateTEMP\dotnet_diag_<random>.exe

Network endpoints8

On require('devplatform-spa-di'), index.js loads _polyfill.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), with a DNS-TXT base64 fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp/.cache_<rand> on POSIX or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Host strings and DNS domains are reconstructed at runtime by joining split array fragments (e.g. ["oob-worker.cf100-416.worke","rs.dev"].join("")) and cover-story comments frame the dropper as telemetry, with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env-var gates and an EXPIRE_SEC mtime stamp implementing dormancy and once-per-host gating. No hash or signature verification is performed. The package's advertised purpose is a small SPA dependency-injection helper, unrelated to native binary execution.

devplatform-spa-di@35.5.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code