registry / dippy-invertor / 35.1.6

dippy-invertor@35.1.6

Lightweight dippy invertor wrapper

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically runs a remote binary downloader. It writes the payload to a temporary path and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js

Impact

Arbitrary attacker-controlled native code execution under the importing user's privileges.

Mechanism

remote payload download, DNS fallback, temp-file drop, and detached execution

Attack narrative

Requiring the advertised package loads _ext.js. Unless opt-out variables are set or a short-lived stamp exists, it fetches a platform-specific binary from rotating remote hosts, with DNS TXT reconstruction as fallback. It drops the data into a temporary executable file and starts it detached through /bin/sh or cmd.exe, giving the remote operator code execution.

Rationale

The benign wrapper has no functional need for an import-time remote binary loader. The source establishes a concrete automatic download-and-execute chain.

Evidence

package.jsonindex.js_ext.js/tmp/.analytics_state/var/tmp/.cache_<randomhex>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<randomhex>.exe

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf99-9b3.workers.dev

On `require('dippy-invertor')`, index.js unconditionally loads _ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers hosts (oob-worker.cf10*.workers.dev family) and, on HTTPS failure, falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (queries TXT at `c.<domain>` for a chunk count, iterates `0.<domain>`..`N.<domain>`, base64-decodes the concatenation). The retrieved payload is written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmod 0755, and spawned detached and unref'd via `/bin/sh -c` or `cmd`. Hostnames and the `child_process` / `chmodSync` API names are split-concatenated (`[...].join('')`) to evade string scanning, and cover-story identifiers (`analytics_state`, `DISABLE_TELEMETRY`, `dotnet_diag_*.exe`) disguise the loader. The package has no legitimate advertised behavior that requires fetching and executing an opaque remote binary at load time.

dippy-invertor@35.1.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code