registry / sme-rko-finance-front-operations-other / 35.8.1

sme-rko-finance-front-operations-other@35.8.1

Build and deployment tools

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package automatically runs a remote binary loader. It retrieves an opaque payload, drops it in a temporary directory, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of the package entrypoint.

Impact

Arbitrary native code executes with the importing process's privileges.

Mechanism

remote payload download, temporary-file drop, and detached execution

Attack narrative

Requiring index.js silently imports _init.js. That module selects a platform payload, fetches it from rotating workers.dev hosts or reconstructs it from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached. The payload is opaque and unverified, allowing its operator to execute arbitrary code under the consumer process.

Rationale

The package's import-time loader implements a concrete remote code execution chain with obfuscated infrastructure and no legitimate package-facing need for native payload execution. Absence of install hooks does not mitigate runtime compromise upon import.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require()/import, _init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written under disguised names (dotnet_diag_*.exe,.cache_*) to /var/tmp or Windows TEMP, chmod'd 0755, and spawned detached via /bin/sh or cmd. A second dropper in lib/telemetry.js (loaded as the main export inside a decoy Sentry-like SDK bundle) base64-decodes downloaded bytes, chmods 0755 via a dynamically constructed property name ("chmod"+"Sync"), and spawns the resulting file detached. Hostnames and dangerous API names are assembled from split string fragments at runtime ("child_"+"process",.join("") over host fragments) to defeat static analysis. No pinning, no hash or signature verification, and the delivered content is opaque and unrelated to any documented package purpose.

sme-rko-finance-front-operations-other@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code