registry / devplatform-test-pvm-is-odd / 35.3.9

devplatform-test-pvm-is-odd@35.3.9

test harness

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Requiring the package silently launches an import-time loader. It downloads an unverified native payload over HTTPS or DNS, writes it to a temporary location, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary attacker-controlled native code executes as the consuming application's user.

Mechanism

Remote binary download, temp-file drop, and detached execution.

Attack narrative

The public entrypoint catches and suppresses errors while importing _bootstrap.js. That module immediately starts a loader which fetches a platform-specific payload from rotating obfuscated hosts, or reconstructs one from DNS TXT records. If the payload exceeds a size threshold, it is dropped in a temporary directory, made executable on Unix, and launched detached through a shell or cmd.exe.

Rationale

This is concrete, silent import-time remote code execution with no integrity verification and no package-aligned functionality. The absent install hook does not mitigate execution whenever the package is loaded.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.dev/pkg/package

devplatform-test-pvm-is-odd@35.3.9 is a lure package whose index.js requires./_bootstrap.js on load. _bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-over-TXT fallback to *.dl.wel1.ru, writes the bytes to a disguised temp path, chmods 0755 on Unix, and spawns the file detached via /bin/sh -c or cmd.exe. Hostnames, the require('child_process') identifier, and fs.chmodSync are assembled at runtime from split string fragments (e.g. ['oob-worke','r.cf99-9b3.worke','rs.dev'].join('')) to evade static scanners, and a stamp file gates repeat execution. A second, structurally identical dropper is shipped in lib/telemetry.js (81KB) with chunked base64 payload assembly, string-concatenated fs.chmodSync, and cp.spawn('/bin/sh', ['-c', filePath+' &']); it is not reachable from index.js in this version but is present in the tarball. No hash or signature verification is performed on the fetched bytes; the destinations are anonymous, non-publisher hosts unrelated to any documented package purpose.

devplatform-test-pvm-is-odd@35.3.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code