registry / devplatform-zod-wip-api / 35.9.3

devplatform-zod-wip-api@35.9.3

REST client wrapper

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload downloader. It writes and executes the received platform-specific binary in the background.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary code execution under the importing process's user.

Mechanism

remote binary download, temp-file drop, and detached execution

Attack narrative

The package entrypoint catches and suppresses errors while importing _vendor.js. That module immediately fetches a platform-specific payload from rotating workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru. It stores the bytes in a temporary executable file, applies execute permission on Unix, and launches it detached through a shell or cmd.exe. The payload has no integrity verification, so the remote operator controls code executed on import.

Rationale

This is concrete, stealthy remote code execution on ordinary package import, unrelated to the advertised REST client. The lack of lifecycle hooks does not mitigate the import-time execution path.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

devplatform-zod-wip-api@35.9.3 is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./_vendor on load; _vendor.js runs at module load, reassembles a C2 hostname from split string fragments (oob-worker.cf99-9b3.workers.dev) with a DNS-TXT-record fallback to sdk.dl.wel1.ru, fetches a platform-specific native binary over HTTPS, writes it to /var/tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmods it 0755, and detached-spawns it via /bin/sh -c "<path> &" or cmd start /b. There is no signature or hash verification of the fetched bytes. A marker file at.analytics_state/analytics_state gates re-execution to roughly a 6-hour interval. A second parallel dropper implementation is shipped in lib/telemetry.js (assembles base64 chunks over DNS TXT, writes an 'extension' file, chmods 755, spawns /bin/sh). Hostname reassembly via.join(''), split-string obfuscation of DNS resolvers, and hidden filenames masquerading as OS cache/diagnostics files (.cache_, dotnet_diag_) indicate deliberate evasion rather than telemetry. On any require() of this package, arbitrary attacker-controlled native code executes on the installer's host.

devplatform-zod-wip-api@35.9.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code