registry / eacq-acq-menu-core / 35.9.7

eacq-acq-menu-core@35.9.7

base framework module

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main module silently starts a remote binary downloader. It drops and executes the received payload detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any require/import of index.js

Impact

Arbitrary native code execution as the importing user.

Mechanism

Remote payload download, disk drop, and detached execution

Attack narrative

Requiring index.js suppresses errors while loading _helpers.js, whose setup runs immediately. It selects a platform payload URL, downloads an opaque binary from rotating worker hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached via a shell or cmd.exe. The payload is neither authenticated nor inspected.

Rationale

This is an import-time staged native payload execution chain unrelated to the package’s stated framework purpose. The absence of an npm lifecycle hook does not mitigate execution on normal module import.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints6

oob-worker.cf100-416.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package

On require(), index.js loads _helpers.js which reconstructs C2 hostnames from split-string arrays (e.g., 'oob-worker.cf*.workers.dev' and 'sdk.dl.wel1.ru') and downloads a platform-specific binary via https.get. The binary is written to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0o755 on Unix, and spawned detached via cmd.exe/start or /bin/sh -c with the '&' background operator. When HTTPS delivery fails, a fallback path queries DNS TXT records at c.<domain> and numbered subdomains under dl.wel1.ru, concatenates the returned chunks, base64-decodes them, and writes the result as the executable payload — a covert DNS-TXT transport for payload delivery. Hostnames are fragmented across arrays and joined at runtime specifically to evade static string search, with cover-story comments ('Retry with exponential backoff', 'DNS-based discovery') inserted around the dropper logic. The package's README presents it as a benign 'base framework module', which does not match the shipped behavior.

eacq-acq-menu-core@35.9.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code