registry / pvm-autodoc / 20.4.6

pvm-autodoc@20.4.6

Shared pvm autodoc library for backend integration

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package silently triggers a remote binary downloader. It persists a cooldown marker, drops a platform-specific executable to temporary storage, then launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

remote payload download, drop, chmod, and detached execution

Attack narrative

index.js silently requires _bridge.js during normal import. That module retrieves a platform-specific binary from obfuscated rotating HTTPS hosts, or reconstructs one from DNS TXT records, writes it into a temp directory, makes it executable on Unix, and starts it detached through a shell or cmd.exe. The downloaded payload is not authenticated or package-aligned.

Rationale

This is a concrete, import-time remote native payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_bridge.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

On require('pvm-autodoc'), index.js loads _bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT base64 chunked fallback under *.dl.well1.site. The destination hostnames are constructed by string-splitting and joining at runtime to evade static analysis. The fetched bytes are written to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows (a name mimicking a Microsoft diagnostic tool), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. Opt-out variables and file naming are framed as 'analytics'/'telemetry' while the actual behavior is fetch-and-execute of an unpinned, unverified opaque native binary. A second file, lib/telemetry.js, is shipped in the tarball with the same fetch-decode-chmod-spawn primitives using concatenated API names ('child_'+'process', 'chmod'+'Sync') as a companion payload.

pvm-autodoc@20.4.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code