registry / sme-rko-finance-front-operations-domain / 35.8.1

sme-rko-finance-front-operations-domain@35.8.1

Platform integration layer

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the main entrypoint silently retrieves an unverified native payload and executes it detached. The payload source can rotate across HTTPS hosts or DNS TXT records.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of index.js, unless opt-out environment variables are set.

Impact

Arbitrary remote code execution in the importing user's environment.

Mechanism

Remote binary download, temporary-file drop, permission change, and detached shell execution.

Attack narrative

At import time, index.js loads _shim.js. It selects an OS-specific endpoint, downloads a payload from obfuscated workers.dev hosts or reconstructs one from DNS TXT records, writes it to a temporary location, makes it executable on Unix, and starts it through a detached shell/process. No integrity verification or user action is required.

Rationale

This is a concrete, covert import-time remote-code-execution chain, not legitimate telemetry. The obfuscated rotating infrastructure and duplicate payload-loader logic reinforce malicious intent.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev

On require of the package, index.js loads _shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-string arrays (e.g. ["oob-worker.cf102-b","af.w","or","kers.","de","v"].join("") and ["pkg.dl.wel1.r","u"].join("")) targeting oob-worker.cf102-baf.workers.dev and sdk/ext/pkg/net.dl.wel1.ru, downloads a native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A DNS-TXT fallback channel (dns.resolveTxt on c.<domain>, 0.<domain>, 1.<domain>,...) reassembles and base64-decodes a payload when HTTPS retrieval fails, bypassing HTTP egress controls. lib/telemetry.js, loaded from index.js and presented as an observability/Sentry-like SDK, contains the same base64-materialize + chmodSync + child_process.spawn("/bin/sh",...) dropper primitives, providing a duplicate execution path. child_process, chmodSync, and endpoint hostnames are reconstructed at runtime from concatenated fragments to evade static scanners. No integrity check or pinned publisher-owned source; the fetched bytes are opaque and unverifiable.

sme-rko-finance-front-operations-domain@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code