prokit-core@20.6.6: Malicious npm security report (Block)

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing prokit-core immediately runs a hidden downloader. It retrieves a platform payload, drops it to a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary attacker-supplied native code executes with the importing process's privileges.

Mechanism

remote binary download, temporary-file drop, and detached shell execution

Attack narrative

The main entrypoint silently requires _helpers.js. On import, its main function records a temporary marker, downloads a platform-specific payload from obfuscated worker domains or DNS TXT records, writes it into a temp directory, grants execute permission on non-Windows hosts, and spawns it detached through /bin/sh or cmd.exe. This is an unconsented remote-code-execution chain.

Rationale

The behavior is reachable during ordinary package import and executes an unauthenticated remote binary without user action. The telemetry naming and opt-out variables do not mitigate the concrete downloader/executor chain.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/package

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12420

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in prokit-core (npm)

Details

On require of the package, index.js unconditionally loads _helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled at runtime by joining split string fragments (e.g. oob-worker.cf101-adf.workers.dev), and falls back to a DNS-TXT covert channel that reassembles a base64 payload from TXT records under *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site, tina.dl.well1.site). The retrieved bytes are written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A /tmp/.analytics_state freshness marker suppresses re-firing to reduce detection, and cover-story comments frame the behavior as telemetry. Installing or importing the package results in execution of attacker-controlled native code on the installer's host.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _helpers.js on every package import.
_helpers.js downloads platform-specific binaries from four worker hosts.
_helpers.js falls back to DNS TXT payload retrieval.
Downloaded data is written under /var/tmp or Windows temp, made executable, and spawned detached.
Execution is hidden and errors are suppressed.

Evidence against

package.json has no lifecycle scripts.
No AI-agent configuration mutation was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.7 KB of source

Source & flagged code

4 flagged

_helpers.jsView file

6const path = require("path"); L7: const https = require("https"); L8: ... L45: const EXPIRE_SEC = 21460; L46: const _l = (...a) => process.stderr.write(""); L47: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_helpers.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> index.js -> _helpers.js L6: const path = require("path"); L7: const https = require("https"); L8: ... L45: const EXPIRE_SEC = 21460; L46: const _l = (...a) => process.stderr.write(""); L47: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_helpers.jsView on unpkg · L6

119try { L120: const cp = require("child_process"); L121: if (isWin) {

High

Child Process

Package source references child process execution.

_helpers.jsView on unpkg · L119

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = twork-data-services-getting-arrests@20.1.1 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:20.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged · loading source

_helpers.jsView file

6const path = require("path"); L7: const https = require("https"); L8: ... L45: const EXPIRE_SEC = 21460; L46: const _l = (...a) => process.stderr.write(""); L47: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_helpers.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> index.js -> _helpers.js L6: const path = require("path"); L7: const https = require("https"); L8: ... L45: const EXPIRE_SEC = 21460; L46: const _l = (...a) => process.stderr.write(""); L47: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_helpers.jsView on unpkg · L6

119try { L120: const cp = require("child_process"); L121: if (isWin) {

Findings

2 Critical2 High2 Medium1 Low

CriticalDownload Execute_helpers.js

CriticalTrigger Reachable Dangerous Capability_helpers.js

HighChild Process_helpers.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem