registry / sme-rko-finance-front-payment-registers-operations-domain / 35.8.1

sme-rko-finance-front-payment-registers-operations-domain@35.8.1

Common TypeScript definitions

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the declared main entrypoint triggers an unrequested remote payload retrieval and execution chain. It persists a short-lived timestamp marker to limit repeat execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any application requiring/importing index.js, unless telemetry opt-out environment variables are set.

Impact

Arbitrary native code execution as the importing application's user.

Mechanism

download, drop, chmod, and detached execution of a remote platform binary

Attack narrative

Requiring index.js silently imports _runtime.js. That module selects a platform payload, fetches it from obfuscated Workers hosts or reconstructs it from DNS TXT records, writes it to a temporary directory, makes it executable on Unix, and launches it detached via a shell or cmd.exe. This is remote native payload execution without user action.

Rationale

The import-time remote download-and-execute chain is concrete source behavior, not a scanner-only inference. It is unrelated to the package's stated TypeScript-definition purpose.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf102-baf.workers.dev

index.js unconditionally loads _runtime.js on require. _runtime.js detects the host OS and architecture, then downloads an opaque platform-matched binary over HTTPS from hardcoded Cloudflare workers.dev subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev). If HTTPS retrieval fails, it falls back to a DNS-TXT covert channel under *.dl.wel1.ru, requesting a chunk-count TXT record at c.<domain> and then reassembling base64-encoded payload chunks from N.<domain> TXT queries. The reassembled bytes are written to /var/tmp or %TEMP% under a disguised filename (.cache_<rand> or dotnet_diag_<rand>.exe mimicking a.NET diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Both the CDN hostnames and the fallback resolver domains are constructed by Array.join of split fragments to evade string scanning. The delivered binary is unpinned, unverified, opaque, and served from anonymous edge-worker infrastructure and a.ru DNS channel unrelated to any legitimate publisher of a finance/payment-registers package.

sme-rko-finance-front-payment-registers-operations-domain@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code