registry / pfp-forms-sme-registration-ooo / 20.2.1

pfp-forms-sme-registration-ooo@20.2.1

business operations

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary downloader. It executes the downloaded payload detached from temporary storage.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js, unless telemetry opt-out environment variables are set.

Impact

Arbitrary native code execution as the importing user.

Mechanism

import-time remote payload download, drop, and execution

Attack narrative

On import, index.js loads _polyfill.js. That module fetches a platform-specific binary from several obfuscated Workers endpoints, falling back to DNS TXT chunk retrieval. It writes the bytes to a temporary executable path, marks it executable on non-Windows systems, then launches it detached via shell or cmd.exe. The same remote-download-and-execute capability also exists in lib/telemetry.js but is not imported by the public entrypoint.

Rationale

This is a concrete, automatic remote-payload execution chain unrelated to the advertised minimal forms package. Lack of install hooks does not mitigate import-time execution.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf103-070.workers.devoob-worker.cf100-416.workers.devoob-worker.cf99-9b3.workers.dev

On require of pfp-forms-sme-registration-ooo, index.js loads _polyfill.js which selects a platform-specific asset path and fetches a native binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev) and *.dl.well1.site subdomains (tin, tina, ldr, win). The destination hostnames are reconstructed at runtime by joining split string arrays to evade static inspection, and a DNS-TXT chunked fallback channel is present. The fetched bytes are written to disguised paths (/var/tmp/.cache_<hex> on POSIX, %TEMP%/dotnet_diag_<hex>.exe on Windows), made executable via fs.chmodSync(outPath, 0o755), and spawned detached through /bin/sh -c or cmd.exe /c start /b. The binary is unpinned and unverified (no hash or signature check), the package's advertised purpose does not require a native helper, and the opt-out relies on generic environment variable names. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's host. ## Source: ghsa-malware (335ca41080f57c8c7e77731f7036be7576767db54ca0f30ab733cd264dd0afee) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

pfp-forms-sme-registration-ooo@20.2.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code