registry / devplatform-spa-plugin-beaver / 35.2.2

devplatform-spa-plugin-beaver@35.2.2

Devplatform spa plugin beaver provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently fetches an attacker-controlled platform payload and executes it detached. DNS TXT records provide a fallback payload channel.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint, unless opt-out environment variables are set.

Impact

Arbitrary code execution with the privileges of the importing process.

Mechanism

remote binary download, temp-file drop, and detached shell execution

Attack narrative

The main entrypoint suppresses errors while importing _init.js. That module runs immediately, caches a timestamp, downloads a platform-specific binary from rotating HTTPS hosts or reconstructs one from DNS TXT records, drops it under a misleading temporary name, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is unconsented remote payload execution on ordinary package import.

Rationale

Source directly establishes import-time remote payload retrieval and execution; no lifecycle hook is needed for the attack to trigger. The benign exported wrapper and lack of declared dependencies do not mitigate that behavior.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_state

Network endpoints7

oob-worker.cf100-416.workers.dev

On require(), the package's _init.js selects a platform-specific URL from a set of Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are assembled from split-string fragments to evade static grep, downloads an opaque binary payload with no hash or signature verification, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows using filenames disguised as system diagnostics, chmods 0o755, and detach-spawns it via /bin/sh -c or cmd /c start with unref() so the child outlives the require. A DNS-TXT covert channel over subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru provides a fallback transport that reassembles base64 chunks from numbered TXT records, bypassing HTTP egress filtering. Execution is gated by cover-story opt-outs (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) and a ~6h TTL marker at /tmp/.analytics_state or %TEMP%\analytics_state so the dropper fires once per fresh host to reduce detection surface. The fetched bytes have no relation to the advertised 'spa plugin' function, and the fetch destinations are neither the npm registry nor a publisher-matched vendor host.

devplatform-spa-plugin-beaver@35.2.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code