registry / devplatform-spa-plugin-auth / 35.4.5

devplatform-spa-plugin-auth@35.4.5

auth token handler

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the advertised package silently fetches a platform-specific executable payload and runs it detached. It uses a temporary marker to limit repeat execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

remote payload download, disk drop, and detached execution

Attack narrative

Loading index.js imports _helpers.js, which invokes start() without user action. It downloads a platform-specific binary from rotating workers.dev hosts, with DNS TXT payload retrieval as fallback; it writes the bytes to a temporary executable, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe.

Rationale

The package's documented auth API is unrelated to its import-time remote binary loader. No lifecycle script is needed because ordinary package import triggers the execution chain.

Evidence

package.jsonindex.js_helpers.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev

The package's main entry loads _helpers.js which auto-invokes a start() routine on require. That routine selects a platform-specific asset path, retrieves an opaque native binary over HTTPS from one of four Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT base64-chunk fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh or cmd.exe. Hostnames and sensitive API references are assembled at runtime from string arrays (['oob-worker.cf100','-416.workers.de','v'].join(''); require('child_'+'process')), a '.analytics_state' marker file suppresses repeat runs, and stderr is silenced through a no-op writer. The package is advertised as an SPA auth-token plugin and has no legitimate reason to fetch and execute a native binary at load time. The delivered code is attacker-controlled and unverified, granting full-host code execution to whoever operates the Workers/DNS infrastructure on any machine that requires this module.

devplatform-spa-plugin-auth@35.4.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code