registry / sme-rko-finance-front-payments-allowed-tariffs-filter / 35.8.1

sme-rko-finance-front-payments-allowed-tariffs-filter@35.8.1

Shared configuration and helpers

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package automatically starts a remote payload loader. It retrieves a platform binary, writes it to a temp directory, makes it executable on Unix, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

remote binary download, drop, and detached execution

Attack narrative

Requiring index.js silently loads _bootstrap.js. Its init routine contacts obfuscated worker hosts for a platform-specific executable, falls back to DNS TXT records, writes the received payload into a temp directory, applies executable permissions on Unix, and starts it through a detached shell or cmd.exe process. The bundled telemetry module contains a parallel native-profiler loader with the same drop-and-execute behavior.

Rationale

This is a concrete import-time remote native payload execution chain, not normal telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require() of the package, _bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflare Workers hosts whose names are reassembled at runtime from string-array fragments (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under cover-story filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. lib/telemetry.js — reached via index.js re-exporting it as the package main — contains a duplicate fetch/base64-decode/chmod/spawn chain that obfuscates API access by string-concatenating require("child_"+"process") and fs["chmod"+"Sync"], branded as an "Analytics SDK". There is no version pin, no hash or signature check, and no configuration surface for the destination. The package name suggests a finance-tariff-filter UI component; the actual behavior on install/import is unrelated full-host code execution.

sme-rko-finance-front-payments-allowed-tariffs-filter@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code