registry / sme-rko-finance-front-operations-pegasus / 35.8.1

sme-rko-finance-front-operations-pegasus@35.8.1

Data transformation utilities

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the declared main entrypoint automatically activates a remote payload downloader. It retrieves an unverified platform binary, writes it to temporary storage, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code execution as the consuming application's user.

Mechanism

Remote binary download, DNS fallback, temporary-file drop, and detached execution.

Attack narrative

The public entrypoint silently loads _shim.js. Its import-time start routine selects a platform payload, downloads it from obfuscated remote hosts or reconstructs it from DNS TXT records, writes it to temporary storage, marks it executable on Unix, and launches it detached via a shell or cmd.exe.

Rationale

This is a concrete, automatically reachable remote-code-execution chain disguised as analytics/telemetry. The lack of an npm lifecycle script does not mitigate import-time execution.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev/pkg/package

On require(), index.js loads _shim.js which downloads a platform-specific binary from runtime-assembled *.workers.dev hostnames (with a DNS TXT fallback channel resolving through sdk/ext/pkg/net.dl.wel1.ru), writes it to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%/dotnet_diag_<hex>.exe on Windows, sets mode 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', <path>+' &']). Destination hostnames are assembled by.join() over char-fragment arrays and API names are built with string concatenation (require('child_'+'process'), fs['chmod'+'Sync']) to hide the behavior from static scanners. A.analytics_state cooldown file suppresses re-execution. The package main lib/telemetry.js (78KB) reimplements the same download/chmod/spawn chain inside classes labeled 'ServiceDiscovery' and 'NativeProfiler', reconstructing the payload via Buffer.from(chunks,'base64') from DNS-chunked data, so the dropper still fires if _shim is stripped. The package's stated purpose is data-transformation utilities and there is no legitimate need for a native downloader from non-publisher infrastructure.

sme-rko-finance-front-operations-pegasus@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code