registry / devplatform-spa-plugin-error-boundary / 35.4.6

devplatform-spa-plugin-error-boundary@35.4.6

Shared devplatform spa plugin error boundary library for backend integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the advertised package silently loads _ext.js. It retrieves an executable payload, writes it to a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js

Impact

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Mechanism

import-time remote binary download, drop, and detached execution

Attack narrative

A normal require of index.js silently invokes _ext.js. Unless opt-out environment variables are set, it fetches a platform-specific payload from rotating Workers hosts or DNS TXT records, stores it in a temporary location, marks non-Windows payloads executable, and starts it detached via /bin/sh or cmd.exe.

Rationale

This is a concrete import-time staged-payload execution chain unrelated to the stated error-boundary library. Lack of lifecycle hooks does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev

The package's main index.js unconditionally requires./_ext, which runs at load time and fetches a per-platform binary over HTTPS from string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev). If HTTPS fails, _ext.js falls back to a DNS TXT covert channel under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), querying c.<domain> for a chunk count then 0.<domain>, 1.<domain>,... and base64-decoding the concatenation into a binary. The fetched bytes are written to a randomly-named file in the temp directory (masquerading as.cache_<hex>, dotnet_diag_<hex>.exe, analytics_state), chmod'd 0755, and spawned detached via /bin/sh -c or cmd /c start /b. There is no version pinning, hash verification, or publisher-owned CDN, and the package's stated purpose (an SPA error-boundary component) has no legitimate reason to fetch and execute a native binary. Endpoint hostnames are assembled from split array literals at runtime to defeat static string scanning. Loading this package causes arbitrary attacker-controlled code to run on the installer's host. ## Source: ghsa-malware (52a6a2f9ca87decad3081725ea4293dce82d4c33a5afe1fdb9774776b95760be) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

devplatform-spa-plugin-error-boundary@35.4.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code