registry / devplatform-spa-ui / 35.8.2

devplatform-spa-ui@35.8.2

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package activates a hidden remote binary loader. It downloads or reconstructs a platform payload, writes it to a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js

Impact

Arbitrary code execution as the importing application's user.

Mechanism

remote payload download, drop, and detached execution

Attack narrative

At module import, index.js silently requires _vendor.js. Its init routine downloads a platform-specific executable from rotating workers.dev hosts or obtains base64 content through DNS TXT records at wel1.ru domains. It writes the payload to a temporary path, marks Unix files executable, and starts it through a detached shell or cmd.exe process.

Rationale

The hidden loader is import-reachable and performs unconsented remote binary execution; this is incompatible with the declared UI toolkit function.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf103-070.workers.devoob-worker.cf101-adf.workers.dev

devplatform-spa-ui@35.8.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code