registry / devplatform-spa-plugin-ability / 35.5.2

devplatform-spa-plugin-ability@35.5.2

Devplatform spa plugin ability SDK for internal consumers

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently launches a remote binary-payload bootstrapper. It downloads or DNS-reconstructs a payload, writes it under a temp directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node process that requires the package entrypoint.

Impact

Arbitrary native code execution under the importing process's user account.

Mechanism

import-time remote payload download, drop, and detached execution

Attack narrative

The declared entrypoint catches and suppresses errors while importing _bootstrap.js. That module fingerprints the platform, downloads a platform-specific executable from rotating obfuscated workers.dev hosts or reconstructs one from DNS TXT records, saves it in a temporary directory, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is unconsented import-time arbitrary code execution.

Rationale

This is a concrete staged payload chain reachable on ordinary import, not a configured telemetry feature. No lifecycle hook is needed because the malicious action runs from the main entrypoint.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random-hex>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random-hex>.exe

Network endpoints8

On require of the package, index.js loads _bootstrap.js which downloads a platform-specific native binary from anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (chunk count in c.<domain>, N shards concatenated and base64-decoded into an executable buffer). Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf102-baf.worke","rs.d","ev"].join("")). The fetched binary is written to disguised paths (/var/tmp/.cache_<hex>, %TEMP%\dotnet_diag_<hex>.exe, /pkg/package.exe|-arm64|loader_mac), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start with no hash or signature verification. A lib/telemetry.js decoy file and an.analytics_state rate-limit stamp plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env-var gates provide cover-story framing; the delivered payload is unrelated to the package's stated purpose (an "SPA plugin ability SDK"). Installing or requiring this package executes attacker-controlled code on the installer host.

devplatform-spa-plugin-ability@35.5.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code