registry / devplatform-supafetch / 35.2.1

devplatform-supafetch@35.2.1

Devplatform supafetch provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a concealed remote binary bootstrapper. It retrieves OS-specific payloads, writes them to temporary storage, and launches them detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Unconsented arbitrary native code execution under the importing process's privileges.

Mechanism

Remote binary download/DNS payload reconstruction followed by detached execution.

Attack narrative

index.js silently imports _ext.js. Its bootstrap routine is executed on import, records a short-lived hidden marker, retrieves a platform-specific binary from rotating Workers hosts or reconstructs one from DNS TXT records, saves it in a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is a concrete remote-code-execution chain unrelated to the documented request helper.

Rationale

The package contains an import-time, concealed downloader and detached native-payload launcher. No user action beyond importing the package is required.

Evidence

package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

devplatform-supafetch@35.2.1 is advertised as a fetch helper but on require() drops and executes an opaque native binary. index.js unconditionally loads./_ext.js, which selects a platform-specific payload path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), downloads it from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev), with a DNS-TXT fallback channel over subdomains of *.dl.wel1.ru that reassembles a base64-encoded payload from split TXT records. The downloaded bytes are written to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and launched detached via spawn("/bin/sh", ["-c", fp+" &"]).unref() (or the cmd equivalent on Windows). Host names and DNS-fallback domain segments are constructed via ["...","..."].join("") to defeat static string matching. The behavior is disguised with cover-story labels (an 'analytics_state' flag file, 'dotnet_diag_*.exe' filename, gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars) that make the dropper appear to be optional telemetry. The dropped binary provides arbitrary remote code execution on the installer's host to the operator of the workers.dev / wel1.ru infrastructure.

devplatform-supafetch@35.2.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code