registry / statist-browser-typed-client-risktech.uwfrontantifraud.events / 20.1.5

statist-browser-typed-client-risktech.uwfrontantifraud.events@20.1.5

domain event handler

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package triggers a background loader. It fetches an opaque platform-specific payload, writes it to temporary storage, then executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of the main index.js entry point.

Impact

Arbitrary remote code execution under the importing user's privileges.

Mechanism

remote payload download/DNS retrieval followed by detached native execution

Attack narrative

Loading index.js imports _compat.js. Its bootstrap fetches an opaque binary from rotating workers.dev hosts or reconstructs one from DNS TXT records, stores it in a temporary location, makes Unix payloads executable, and starts it detached via a shell or cmd.exe. This is an undisclosed remote-code loader activated at import time.

Rationale

The source implements concrete, undisclosed remote binary retrieval and execution on import. The absence of lifecycle hooks does not mitigate this reachable runtime execution chain.

Evidence

package.jsonindex.js_compat.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev

On `require`/`import`, `_compat.js` (reached from `index.js`) downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains (`oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf103-070.workers.dev`) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under `well1.site` (`c.<domain>`, `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site`). The fetched bytes are written to `/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows under disguised cache/diagnostic names, chmod +x'd, and spawned detached via `/bin/sh -c '<path> &'` or `cmd`. The C2 hostnames are constructed by joining split string fragments to evade static analysis. A cooldown flag file (`/tmp/.analytics_state` or `%TEMP%/analytics_state`) suppresses re-execution for ~22046 seconds, and execution is gated on `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` env vars as a telemetry cover story. The destinations are anonymous Cloudflare Workers subdomains and a lookalike DDNS-style domain unrelated to any legitimate publisher; no integrity verification is performed on the downloaded binary. ## Source: ghsa-malware (b65fe20ba064c24727682a5b30644004edf48aee92b5317d9332e31c02910269) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

statist-browser-typed-client-risktech.uwfrontantifraud.events@20.1.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code