registry / devplatform-utils / 35.5.2

devplatform-utils@35.5.2

common helpers

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous remote binary downloader and launcher. It persists a short-lived rate-limit marker and executes the downloaded payload detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the main index.js entrypoint.

Impact

Arbitrary native code execution under the importing process account.

Mechanism

remote binary download, temp-file drop, and detached execution

Attack narrative

The package's normal main entrypoint silently imports _bootstrap.js. That module fetches a platform-specific binary from rotating workers.dev hosts, or reconstructs one from DNS TXT records, writes it to a temporary location, then launches it detached via cmd.exe or /bin/sh. The behavior is concealed behind telemetry naming and broad error suppression.

Rationale

This is a concrete import-time staged payload execution chain, unrelated to the declared helper-library purpose. Absence of an npm lifecycle hook does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf103-070.workers.dev/pkg/package

devplatform-utils@35.5.2 ships an index.js whose main module require()s _bootstrap.js, which on load downloads a platform-specific binary payload from string-split-obfuscated Cloudflare Workers endpoints (e.g. oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback via *.dl.wel1.ru. The payload is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Destination hostnames are assembled at runtime by.join('') on fragmented string arrays (_NODES, _DNS_MAP) to evade static string scans, and the dropped file is given cover-story names (dotnet_diag_*,.cache_*,.analytics_state). A rate-limit token stored at /tmp/.analytics_state (EXPIRE_SEC=21227, ~5.9 hours) causes the remote binary to be re-fetched and re-executed on subsequent require() calls, providing a persistent operator-controlled code-delivery channel. Environment variables DISABLE_TELEMETRY / DO_NOT_TRACK are checked as a cover story consistent with a legitimate telemetry opt-out. No hash or signature verification is performed on the fetched binary.

devplatform-utils@35.5.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code