registry / devplatform-spa-plugin-module-loader / 35.8.5

devplatform-spa-plugin-module-loader@35.8.5

Devplatform spa plugin module loader runtime support module

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the advertised package automatically executes a concealed native-payload loader. It fetches an arbitrary binary, drops it in a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer requires or imports the package entrypoint.

Impact

Remote operators can execute arbitrary code as the importing user's account.

Mechanism

remote binary download, temp-file drop, and detached execution

Attack narrative

index.js silently imports _platform.js whenever the documented package is loaded. That module fetches a platform-specific payload over HTTPS, with DNS TXT records as fallback; writes it under a misleading temporary filename; makes it executable on Unix; and launches it detached through /bin/sh or cmd.exe. The bundled telemetry module independently implements the same downloader-and-launch pattern.

Rationale

The import-time remote payload execution chain is concrete and independent of install hooks. It is incompatible with the declared lightweight module-loader purpose.

Evidence

package.jsonindex.js_platform.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.dev

On require, index.js unconditionally loads _platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from subdomains of dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and detached-spawned via cp.spawn('/bin/sh', ['-c', fp+' &']) or the Windows equivalent. Destination hostnames and the child_process API name are assembled by joining split string fragments (e.g. ['sdk.','dl.wel1.','ru'].join('')); dropped-file names mimic legitimate cache/diagnostic paths; cover-story comments reference SHA-256 integrity checks and rate limiting with no matching code; an opt-out env var (DISABLE_TELEMETRY) frames the behavior as analytics. The workers.dev destinations are anonymous, mutable, and unrelated to any legitimate publisher of a module-loader package.

devplatform-spa-plugin-module-loader@35.8.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code