registry / peter-desktop-peter-big-column / 20.3.2

peter-desktop-peter-big-column@20.3.2

Peter desktop peter big column abstraction layer

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload downloader. It retrieves a binary over HTTPS or DNS TXT, drops it to a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

require/import of index.js at application runtime

Impact

Unconsented arbitrary native-code execution under the importing process's user account.

Mechanism

remote binary download, temporary-file drop, and detached execution

Attack narrative

The nominal entrypoint catches and suppresses errors while importing _runtime.js. That module contacts randomized remote hosts for a platform-specific payload, with DNS TXT retrieval as a fallback. If a payload exceeds 1,000 bytes, it writes a randomized executable into a system temporary directory, chmods it on Unix, and launches it detached through a shell or cmd.exe.

Rationale

This is an import-time staged payload loader with covert fallback transport and detached execution; it is unrelated to the documented abstraction-layer API.

Evidence

package.jsonindex.js_runtime.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.devoob-worker.cf100-416.workers.devoob-worker.cf102-baf.workers.dev

On require(), index.js loads _runtime.js which assembles download hostnames at runtime from split string fragments (resolving to oob-worker.cf99-9b3.workers.dev and *.dl.well1.site) and fetches a platform-specific binary via HTTPS with a DNS TXT fallback channel. The retrieved bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c '<path> &' or cmd /c start. A deduplication lockfile is disguised as an analytics stamp. lib/telemetry.js ships a second copy of the same fetch-write-chmod-spawn dropper under an 'apm.node' SDK guise. The delivered binary is attacker-controlled and opaque; string-array hostname assembly hides the destinations from static inspection. ## Source: ghsa-malware (f32b3a902fd3a5d1670e17f292b6891a373c0f1c262af183b3e0aa35169935c8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

peter-desktop-peter-big-column@20.3.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code