registry / pfp-forms-independent-sme-glossary-anchor / 20.4.4

pfp-forms-independent-sme-glossary-anchor@20.4.4

business operations

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package executes a hidden loader. It retrieves an opaque native payload over HTTPS or DNS, drops it into a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import/require of the package entrypoint.

Impact

Arbitrary remote code execution under the importing user's privileges.

Mechanism

Remote binary download, temp-file drop, chmod, and detached process execution.

Attack narrative

On ordinary require(), index.js silently imports _compat.js. Its immediately invoked main function fetches a platform-specific opaque payload from rotating HTTPS hosts, or reconstructs one from DNS TXT records. It writes the payload to a temp path, grants execute permission on non-Windows systems, and launches it through a detached shell or cmd.exe process. The module suppresses errors and uses generic telemetry names to obscure the behavior.

Rationale

This is a concrete, import-time remote payload execution chain unrelated to the package's stated minimal API. The lack of lifecycle scripts does not mitigate execution when consumers import it.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev

On require of the package, index.js loads _compat.js which reconstructs mirror hostnames via string-splitting joins (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev) with a DNS TXT-record fallback under *.dl.well1.site, fetches a platform-specific binary via https.get, writes it to a disguised path under /var/tmp or %TEMP% (e.g..cache_<hex> or dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. A second equivalent dropper is bundled in lib/telemetry.js (Buffer.from(chunks,'base64'), chmodSync 0o755, cp.spawn('/bin/sh',['-c',filePath+' &'])) as an alternate staging path. Hostname reconstruction via array-join fragments and library-load-time execution place this outside legitimate native-binary install patterns.

pfp-forms-independent-sme-glossary-anchor@20.4.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code