registry / devplatform-spa-plugin-module / 35.7.9

devplatform-spa-plugin-module@35.7.9

Internal devplatform spa plugin module module for platform services

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main module triggers an embedded remote payload loader. It fetches or DNS-reconstructs a binary, stores it in temporary storage, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

import-time remote binary download, drop, chmod, and detached execution

Attack narrative

Requiring the documented package entrypoint silently loads _polyfill.js. That module contacts obfuscated worker domains for an OS-specific payload, or reconstructs one from DNS TXT records. Once a payload exceeds 1000 bytes, it writes it to a temporary file, makes it executable on Unix, and launches it through a detached shell or cmd.exe process.

Rationale

The package has a concrete import-time remote-code-execution chain with no consent, verification, or package-aligned purpose. Lack of npm lifecycle hooks does not mitigate this runtime trigger.

Evidence

index.js_polyfill.jspackage.jsonREADME.md/tmp/.analytics_state/var/tmp/.cache_<uid>%TEMP%/analytics_state%TEMP%/dotnet_diag_<uid>.exe

Network endpoints8

oob-worker.cf100-416.workers.dev

On require of the package's main entry, _polyfill.js executes init() which reconstructs destination hostnames via array-join string splits (e.g. ["oob-worke","r.cf100-416.worker","s.","dev"].join("")), selects a platform-specific endpoint, downloads an opaque binary via https.get from one of several Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev), writes the payload to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true,stdio:"ignore"}).unref() or spawn("cmd",...). If HTTPS retrieval fails, a fallback path resolves TXT records at c.<discovery-domain> and iteratively at N.<discovery-domain> under *.dl.wel1.ru (sdk/ext/pkg/net subdomains), base64-concatenates the chunks, and treats the result as the executable payload. Host reconstruction, disguised file names, staging in temp directories, detached execution, and a DNS TXT covert-channel fallback together constitute a fully productionized install-time dropper delivering arbitrary attacker code to any machine that installs or requires this package.

devplatform-spa-plugin-module@35.7.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code