registry / devplatform-spa-plugin-i18next-instance / 35.5.9

devplatform-spa-plugin-i18next-instance@35.5.9

language pack manager

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Normal require/import activates setup.js. It retrieves an unverified executable payload, stores it in a temporary directory, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer imports the package through its declared index.js entrypoint.

Impact

Arbitrary attacker-controlled native code can run under the importing user's account.

Mechanism

remote binary download, temporary-file staging, and detached execution

Attack narrative

The declared entrypoint silently loads setup.js on every normal import. That module selects a platform-specific path, downloads bytes from obfuscated worker hosts, falls back to DNS TXT payload reconstruction, writes an executable to a temp location, marks it executable on Unix, and launches it detached via shell or cmd.exe. This is unrelated to the advertised locale-resource functionality and gives the remote operator code execution.

Rationale

Source directly establishes an import-time remote payload execution chain. The absence of an install lifecycle hook does not mitigate execution when the package is used.

Evidence

package.jsonindex.jssetup.jslib/telemetry.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints8

On require/import, index.js silently loads setup.js inside a try/catch. setup.js downloads a platform-specific binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-chunked DNS TXT fallback on sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru if HTTPS fails. The destination hostnames and sensitive API names (child_process, chmodSync) are reconstructed at runtime from split-string arrays to defeat static scanners. The downloaded bytes are written to /var/tmp/.cache_<rnd> or TEMP/dotnet_diag_<rnd>.exe, chmod 0755, then spawned detached via /bin/sh or cmd. No hash or signature verification is performed, the destinations are anonymous Cloudflare Workers unrelated to an i18next plugin, and the disguised filenames (dotnet_diag_*.exe,.cache_*) impersonate unrelated system components. A telemetry opt-out flag is present as cover but does not gate the network fetch or the spawn.

devplatform-spa-plugin-i18next-instance@35.5.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code