dlp-dlp-core@35.1.3: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the declared main entrypoint triggers a hidden downloader and detached native payload execution. The payload source is remote and platform-specific.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any require/import of dlp-dlp-core

Impact

Unconsented remote code execution with the importing process user's privileges.

Mechanism

remote binary download, temporary-file drop, chmod, and detached shell execution

Attack narrative

The manifest's main entrypoint is index.js, which silently requires setup.js. On import, setup.js selects a platform binary path, fetches a payload from obfuscated workers.dev hosts or reconstructs one from DNS TXT records under dl.wel1.ru, writes it to a temporary directory, makes it executable on Unix, and launches it through a detached shell or cmd.exe. This is a concrete remote payload execution chain.

Rationale

This is concealed import-time remote binary execution, not package-aligned telemetry. The absence of an npm lifecycle hook does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.jssetup.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.devoob-worker.cf103-070.workers.dev

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13278

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dlp-dlp-core (npm)

Details

On `require('dlp-dlp-core')`, index.js loads setup.js which selects a platform-specific path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), downloads bytes over HTTPS from string-obfuscated Cloudflare Workers mirrors (oob-worker.cf102-baf.workers.dev, cf103-070, cf100-416, cf99-9b3.workers.dev), writes them to /var/tmp/.cache_<hex> or Temp/dotnet_diag_<hex>.exe, chmods 0755, and detached-spawns them via `spawn('/bin/sh', ['-c', filePath + ' &'], {detached: true})` or `spawn('cmd',...)`. A fallback covert-retrieval channel uses DNS TXT lookups against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reassembling base64 chunks and executing the result. Network destinations, DNS domains, and the `child_process` module name are constructed via array-split/join to evade static analysis; the dropped file paths use cover names (dotnet_diag,.cache_,.analytics_state). lib/telemetry.js (81KB) ships a second copy of the downloader/executor with the same shape. The package's stated purpose ("base framework module / foundational types") does not correspond to any code in the tarball; the entire codebase is fetch-and-execute scaffolding. Env-var opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide a telemetry cover story.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports ./setup on every package require.
setup.js downloads platform binaries from obfuscated workers.dev mirrors, with dl.wel1.ru DNS TXT fallback.
setup.js writes the downloaded payload to /var/tmp or Windows temp, marks it executable, and launches it detached.
Execution is import-time, requires no lifecycle hook or explicit API call.

Evidence against

package.json contains no lifecycle scripts.
No AI-agent configuration mutation was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.9 KB of source

Source & flagged code

4 flagged

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

504L505: fork() { L506: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L504

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

setup.jsView file

2Trigger-reachable chain: manifest.main -> index.js -> setup.js L2: L3: const https = require("https"); L4: const os = require("os"); ... L43: const STAMP_TTL = 22574; L44: const _l = (...a) => process.stderr.write(""); L45: ... L54: const isWin = _p("platform") === "win32"; L55: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L56: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L88: try { L89: require("dns").resolveTxt(d, (e, rr) => { L90: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

setup.jsView on unpkg · L2

Source & flagged code

4 flagged · loading source

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

504L505: fork() { L506: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L504

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L117: const _logger = new Logger( L118: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L119: ); ... L225: "BUILD_NUMBER", L226: "GITHUB_ACTIONS", L227: "GITLAB_CI", ... L276: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L277: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

Findings

2 Critical1 High3 Medium3 Low

CriticalDownload Executelib/telemetry.js

CriticalTrigger Reachable Dangerous Capabilitysetup.js

HighChild Processlib/telemetry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowWeak Cryptolib/telemetry.js

LowFilesystem

LowHigh Entropy Strings