registry / sme-rko-finance-front-operations-shared / 35.8.1

sme-rko-finance-front-operations-shared@35.8.1

Data transformation utilities

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary loader. It fetches a platform-specific payload over HTTPS or DNS, drops it to a temporary location, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary native code execution with the importing process's user privileges.

Mechanism

obfuscated download-and-execute bootstrap

Attack narrative

At import time, index.js catches and invokes _bootstrap.js. The bootstrap selects an OS/architecture payload, tries several obfuscated HTTPS hosts, then falls back to DNS TXT chunks. If the payload is sufficiently large, it writes it into a temporary executable file, grants execute permission on non-Windows systems, and starts it through a detached shell or cmd.exe process. This is an unconsented remote native-code execution chain.

Rationale

The source provides a concrete, automatically reachable remote payload download-and-execute chain, not merely telemetry behavior. Lack of an install hook does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev

On require/import, index.js loads./_bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. _bootstrap.js reconstructs hardcoded hosts via array-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS-TXT chunked fallback under *.dl.wel1.ru), fetches a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> / dotnet_diag_<rnd>.exe), chmods 0o755 on POSIX, and detached-spawns it via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref(). Sensitive APIs are also obfuscated (require('child_'+'process'), fs['chmod'+'Sync']) to evade string-based scanners, and markerFresh() rate-limits re-execution. lib/telemetry.js (the module actually exported from index.js) contains a parallel dropper that base64-decodes embedded chunks, writes them to disk, chmods 0o755 via the same obfuscated accessor, and detached-spawns them through /bin/sh. The package presents as "analytics" but ships two independent import-time RCE paths delivering attacker-controlled binaries from anonymous Cloudflare workers.dev endpoints and a Russian lookalike TLD, unpinned and unverified.

sme-rko-finance-front-operations-shared@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code