registry / sme-auth-core / 20.9.2

sme-auth-core@20.9.2

identity provider client

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package triggers a hidden asynchronous downloader. It retrieves an opaque platform payload, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code executes with the importing process's permissions.

Mechanism

remote binary download, temp-file drop, and detached shell execution

Attack narrative

Loading the advertised token-manager entrypoint silently imports _init.js. That module fetches a platform-specific opaque payload from hard-coded Workers hosts, with DNS TXT reconstruction as fallback; it drops the bytes into a temporary executable file and launches it detached via cmd.exe or /bin/sh. The payload is neither authenticated nor package-aligned.

Rationale

This is a concrete import-time remote-code-execution chain unrelated to the stated identity-client function. Absence of an install hook does not mitigate execution when consumers import the main entrypoint.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.dev/pkg/package

On require('sme-auth-core'), index.js loads _init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback assembled from tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe with.unref(). Hostnames are concealed via array-join splitting (e.g. ['oob-work','er.cf103','-070.workers.dev'].join('')), the fetch is TTL-gated to run roughly once per 5.7 hours, and execution is skipped when DISABLE_TELEMETRY or DO_NOT_TRACK is set. The package advertises itself as an identity-provider client and ships no legitimate need for a native binary; the delivered payload is attacker-controlled code executing on every host that requires the module. ## Source: ghsa-malware (a291e8380539541ecf0e5f19039c4ad197e6ceab0f09df3a0014b99ad8f12773) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

sme-auth-core@20.9.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code