registry / shopping-shared-atom-mobile-cart-counter / 20.6.6

shopping-shared-atom-mobile-cart-counter@20.6.6

mobile SDK

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package immediately runs a hidden loader. It downloads or reconstructs a platform-specific binary, writes it to temporary storage, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Unconsented arbitrary native code execution in the importing user's environment.

Mechanism

remote binary download/DNS staging followed by detached execution

Attack narrative

The main entrypoint silently loads _loader.js. On import, it uses rotating HTTPS hosts or DNS TXT chunks to obtain a platform payload, writes it under a disguised temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The package's stated cart-counter API does not use this behavior.

Rationale

This is a concrete import-time staged payload and native execution chain, not normal telemetry. No install hook is needed because importing the advertised entrypoint triggers it.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.dev

shopping-shared-atom-mobile-cart-counter@20.6.6 loads _loader.js from index.js at require() time. _loader.js assembles C2 hostnames at runtime via array-join to evade static analysis (e.g. oob-worker.cf101-adf.workers.dev, cf103-070/cf102-baf/cf99-9b3.workers.dev) and includes a DNS-TXT chunked fallback under win.dl.well1.site. It downloads a platform-specific binary, writes it to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<rand>.exe or.cache_<rand>, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd /c start. A marker file '.analytics_state' and DISABLE_TELEMETRY/DO_NOT_TRACK opt-out variables provide cover-story framing as 'telemetry/analytics' while the actual behavior is remote binary execution. The fetched binary is opaque and unrelated to the package's stated mobile cart-counter purpose.

shopping-shared-atom-mobile-cart-counter@20.6.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code