registry / sme-rko-finance-front-operations-fee / 35.8.1

sme-rko-finance-front-operations-fee@35.8.1

Common TypeScript definitions

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the main package silently runs a platform-specific remote payload loader. It retrieves, writes, and detached-executes an unverified binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import of index.js.

Impact

Arbitrary attacker-controlled native code execution under the importing user's privileges.

Mechanism

remote binary download/DNS staging followed by detached execution

Attack narrative

index.js catches and suppresses errors while importing _vendor.js. That module selects an OS payload, fetches it from concealed Workers hosts or reconstructs it via DNS TXT records, stores it in a temporary directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The package therefore enables attacker-controlled code execution whenever its main entrypoint is imported.

Rationale

The concrete import-time staged payload chain is independently confirmed in source. Absence of an npm lifecycle hook does not mitigate execution on normal package use.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf103-070.workers.dev/pkg/package

The package's main entry (`./lib/telemetry`) and its `_vendor.js` module execute a binary dropper at require/import time. Hostnames and API identifiers are reconstructed from split-string arrays to evade static search — for example `["oob-worker.cf103-070.worke","rs.d","ev"].join("")` and `require("child_"+"process")` / `fs["chmod"+"Sync"]`. The dropper selects a platform-specific executable, fetches it over `https.get` from anonymous Cloudflare `workers.dev` origins (`oob-worker.cf103-070.workers.dev`, `cf100-416.workers.dev`, `cf99-9b3.workers.dev`, `cf101-adf.workers.dev`), with a base64 DNS-TXT fallback channel over `*.dl.wel1.ru` (e.g. `sdk.dl.wel1.ru`). The fetched bytes are written to `/var/tmp/.cache_<hex>` on Linux or `%TEMP%\dotnet_diag_<hex>.exe` on Windows, `chmod 0755` is applied, and the file is spawned detached via `/bin/sh -c "<path> &"` or `cmd /c start /b`. A parallel dropper path inside `lib/telemetry.js` performs the same fetch → base64-decode → chmod +x → detached spawn sequence. No pinning, no signature verification, and mutable anonymous hosts. Installing or requiring the package results in remote code execution on the installer's host.

sme-rko-finance-front-operations-fee@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code