registry / devplatform-spa-plugin-root-sentry / 35.4.5

devplatform-spa-plugin-root-sentry@35.4.5

Shared devplatform spa plugin root sentry library for backend integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically starts a remote payload loader. It retrieves platform-specific binaries, drops them in temporary storage, and runs them detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the main entrypoint.

Impact

Arbitrary native code execution under the importing process user.

Mechanism

Remote binary download, DNS fallback, temp-file drop, and detached execution.

Attack narrative

The public entrypoint silently requires _bootstrap.js. On import, it selects hidden remote hosts or DNS TXT discovery, fetches a platform payload, writes it to a temporary executable-looking cache file, makes it executable on Unix, and launches it through a detached shell or cmd.exe process. Failures are suppressed and a timestamp file throttles retries.

Rationale

This is a concrete import-time remote payload execution chain, not telemetry: downloaded bytes are written and executed without validation or user action. The benign-looking exported API and absence of lifecycle hooks do not prevent runtime compromise.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires _bootstrap.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with hostnames reconstructed at runtime via array-join to evade literal detection, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh or cmd. If HTTPS mirrors fail, a DNS-TXT fallback channel queries c.<domain> at sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru for a chunk count and reassembles base64-encoded payload chunks from N.<domain> TXT records. A second file lib/telemetry.js contains an unreferenced variant of the same dropper. The Cloudflare Workers and wel1.ru destinations are unrelated to any legitimate Sentry infrastructure, and the package's advertised functionality is a cover story around the dropper.

devplatform-spa-plugin-root-sentry@35.4.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code