registry / distributorblock / 35.8.1

distributorblock@35.8.1

API client wrappers

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package silently fetches a platform-specific executable payload and runs it in the background. The payload may also be delivered as base64 data over DNS TXT records.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code execution under the importing process user.

Mechanism

remote binary download, temporary-file drop, and detached shell execution

Attack narrative

Loading index.js imports setup.js, which invokes main() immediately. It downloads an opaque platform-specific payload from hard-coded workers.dev hosts, falling back to DNS TXT records, stores it under /var/tmp or the system temp directory, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe.

Rationale

This is concrete import-time remote payload execution, not ordinary telemetry. No install hook is needed because requiring the advertised package entrypoint triggers the behavior.

Evidence

index.jssetup.jslib/telemetry.js

Network endpoints8

oob-worker.cf99-9b3.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf100-416.workers.devsdk.dl.wel1.ru

The package's main entry (index.js) re-exports a decoy telemetry module and unconditionally require()s setup.js. On require, setup.js selects a platform-specific path, downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts under oob-worker.cf*.workers.dev (assembled via string concatenation to obscure the literal), writes it to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). A /tmp flag file rate-limits repeated runs and a DO_NOT_TRACK check gates execution. When HTTP retrieval fails, setup.js reassembles the payload from base64-encoded chunks served over DNS TXT records at c.<domain> and 0..N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru — a covert channel that bypasses HTTP egress controls. The package's declared purpose ("API client wrappers") is inconsistent with fetching and executing a native binary at import time, and author metadata is empty. The naming (.cache_, dotnet_diag_), detached spawn, and DNS-TXT fallback are consistent with a trojan dropper designed to evade both sandboxing and network defenses.

distributorblock@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code