registry / devplatform-spa-plugin-sentry / 35.1.1

devplatform-spa-plugin-sentry@35.1.1

Shared devplatform spa plugin sentry library for backend integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a concealed remote binary downloader and launcher. It persists only a short-lived marker but executes an unverified downloaded payload detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import or require of devplatform-spa-plugin-sentry

Impact

Arbitrary code execution as the importing process user.

Mechanism

remote payload download, temporary-file drop, and detached execution

Attack narrative

Requiring index.js silently requires _helpers.js. Its async main routine selects a platform payload, fetches it from rotating Workers hosts or reconstructs it from DNS TXT records, writes it to a temporary directory, makes it executable on Unix, and starts it detached via shell or cmd.exe. No integrity validation or user action is required.

Rationale

The package has no install hook, but its normal import path performs concealed download-and-execute behavior. This is concrete arbitrary code execution, not package-aligned Sentry telemetry.

Evidence

index.js_helpers.jspackage.json/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf101-adf.workers.dev/pkg/package

devplatform-spa-plugin-sentry@35.1.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code