registry / sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl / 35.8.1

sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl@35.8.1

API client wrappers

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Importing the package automatically activates a remote binary loader. It fetches a platform-specific payload, drops it in temporary storage, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import of index.js.

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

Remote payload download, temp-file drop, and detached shell execution.

Attack narrative

The main entrypoint silently imports _bootstrap.js. On import, it selects a platform payload, retrieves it from obfuscated Workers hosts or DNS TXT records, writes it to a temp path, chmods it on Unix, and launches it through a detached shell or cmd.exe. The behavior is concealed behind telemetry naming, silent errors, randomized filenames, and a short-lived marker file.

Rationale

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. No lifecycle hook is needed because index.js reaches the loader whenever consumers import the package.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.dev/pkg/package

On require() of the package, index.js loads _bootstrap.js which downloads a platform-specific native binary from Cloudflare Workers subdomains assembled at runtime from split-string arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT covert-channel fallback to *.dl.wel1.ru. The fetched bytes are written to /tmp/.cache_<rnd> on Unix or %TEMP%\dotnet_diag_<rnd>.exe on Windows (a filename that mimics a Microsoft.NET diagnostic tool), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). Execution is gated by a state flag at /tmp/.analytics_state. Destination hostnames are constructed from fragmented substrings (e.g. ["oob","-worker.c","f99","-9b3.wor","kers.d","ev"].join("")) to evade static analysis, and the surrounding code is framed as runtime analytics/telemetry with DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK opt-out variables — a cover story inconsistent with dropping and executing an unsigned native binary from Workers subdomains and a.ru fallback. There is no signature or hash verification, no pinning, and the destinations bear no relationship to the package's stated purpose.

sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code