registry / specials-resources-server / 35.8.1

specials-resources-server@35.8.1

Internal utility module

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Importing the package immediately starts an asynchronous remote payload loader. It downloads or DNS-reconstructs a platform-specific binary, drops it in a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary attacker-controlled native code executes as the importing process user.

Mechanism

Remote binary download/DNS staging followed by detached execution.

Attack narrative

Requiring index.js silently loads _shim.js. Its init routine fetches a platform-specific binary from obfuscated worker domains, with DNS TXT chunk retrieval as a fallback. It writes the payload to /var/tmp (or the Windows temp directory), makes it executable on Unix, and starts it via a detached shell or cmd.exe process. The exported telemetry module contains a parallel configurable native-profiler loader with the same drop-and-execute pattern.

Rationale

This is concrete import-time staged payload execution, not normal telemetry: the downloaded bytes are executed without signature or hash verification. The absence of lifecycle hooks does not mitigate runtime compromise on package import.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf101-adf.workers.dev

specials-resources-server@35.8.1 is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main (lib/telemetry.js) and _shim.js execute the same payload on require(): they select a platform-specific path, fetch an opaque binary from a rotating list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-decode chunks, write to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmod 0755, and detached-spawn via /bin/sh -c or cmd /c start. The destination hosts are anonymous Cloudflare Workers subdomains, not the package publisher; there is no hash or signature verification; the on-disk names impersonate cache and dotnet-diagnostic files. Endpoint hostnames and privileged API names (child_process, chmodSync) are reconstructed by string-concatenation and array-join to evade literal-string scanners, and a /tmp/.analytics_state TTL marker gates re-execution. Any consumer that imports the package triggers the dropper. ## Source: ghsa-malware (cbb3887b9c3ca309351d2a82525382a65eecc014f7e5909f4e2d18bd8bd38ab0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

specials-resources-server@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code