registry / devplatform-spa-plugin-s3-module-loader / 35.8.2

devplatform-spa-plugin-s3-module-loader@35.8.2

Devplatform spa plugin s3 module loader provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically fetches a remote platform-specific payload and executes it detached. It leaves a temporary timestamp marker to throttle repeated runs.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Untrusted remote code executes with the importing process's privileges.

Mechanism

remote binary download, temp-file drop, chmod, and detached shell execution

Attack narrative

When an application imports this package, index.js silently loads _adapter.js. The adapter fetches a platform-specific executable from hard-coded worker domains, falling back to DNS TXT payload reconstruction, writes it under a temp directory, makes it executable on Unix, and starts it detached via /bin/sh or cmd.exe. The payload is neither authenticated nor user-invoked.

Rationale

This is concrete import-time remote code execution, not normal module-loader behavior. The unused telemetry-like implementation in lib/telemetry.js reinforces the deceptive payload-loader pattern.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf102-baf.workers.devoob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.dev

On require of the package's main entry, index.js loads _adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) assembled from split string arrays, writes them to a hidden temp path (dot-file on Unix, dotnet_diag_*.exe on Windows), chmods 0755 on Unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. A DNS-over-TXT fallback resolves c.<domain>/i.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-reassembles a payload from numbered TXT records when HTTPS delivery is blocked. Destinations, delivery channels, and payloads are fully author-controlled, obfuscated via runtime string reassembly, and unrelated to the package's advertised S3-module-loader purpose. Cover-story identifiers include analytics_state and DISABLE_TELEMETRY.

devplatform-spa-plugin-s3-module-loader@35.8.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code