registry / pfp-forms-sme-loan / 20.2.1

pfp-forms-sme-loan@20.2.1

small business module

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package immediately loads _bridge.js. It fetches a platform-specific binary or DNS-encoded payload, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of the package

Impact

Unconsented arbitrary native code execution on the importing host

Mechanism

Import-time remote payload download, drop, and detached execution

Attack narrative

The manifest’s main entrypoint loads _bridge.js during normal package import. Unless opt-out environment variables are set, that module contacts hard-coded remote hosts for a platform-specific binary, with DNS TXT reconstruction as fallback. It writes the received bytes to a temporary executable path, marks it executable on Unix, then launches it detached through /bin/sh or cmd.exe. This is a concrete remote-code-execution payload chain without user consent.

Rationale

Source inspection confirms an import-triggered remote binary download and execution chain in _bridge.js. No lifecycle hook is needed because index.js invokes it at runtime.

Evidence

package.jsonindex.js_bridge.jslib/telemetry.js/tmp/.analytics_state/var/tmp

Network endpoints7

oob-worker.cf100-416.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf99-9b3.workers.dev

On require of the package, index.js loads _bridge.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers subdomains whose hostnames are reassembled at runtime via Array.join() to defeat static analysis (e.g. ["oob-worker.cf100-416.workers.de","v"].join("") and ["tin.dl.","well1.s","it","e"].join("")), with a DNS TXT record fallback that reassembles the payload from covert-channel responses. The fetched bytes are written to a temp path under a disguised name (dotnet_diag_*.exe /.cache_*), chmodded 0o755, and executed detached via spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() on Unix or spawn("cmd",...) on Windows. A companion module lib/telemetry.js (not currently wired into the require graph) contains a fuller variant of the same fetch/decode/spawn logic behind a Sentry-style "analytics SDK" cover story, using string concatenation to hide dangerous APIs (require("child_" + "process"), fs["chmod" + "Sync"]). Requiring or installing the package results in execution of attacker-controlled bytes on the installer's host.

pfp-forms-sme-loan@20.2.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code