registry / statist-browser-typed-client-sme.salary.web.metrics / 20.5.9

statist-browser-typed-client-sme.salary.web.metrics@20.5.9

observability bridge

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package silently starts a platform-specific payload downloader. It writes the fetched executable to a temporary directory and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Unconsented remote code execution under the importing process user.

Mechanism

remote binary download, temp-file drop, and detached execution

Attack narrative

At module import, index.js loads _adapter.js, which invokes main(). It fetches a platform payload from rotating workers.dev hosts, falling back to DNS TXT data, writes it to a temporary executable path, chmods it on Unix, and starts it detached through /bin/sh or cmd.exe. The fetched bytes have no implemented hash verification.

Rationale

This is concrete import-time remote payload execution, unrelated to the advertised metrics collector. The absence of an install hook does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_adapter.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

On require(), _adapter.js fetches a platform-specific binary payload from split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT resolver fallback under *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). The fetched bytes are written to /var/tmp or %TEMP% under cover-story names (.cache_<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmod 0755'd on POSIX, and spawned detached via /bin/sh or cmd.exe. There is no hash or signature verification of the fetched payload. Endpoint hostnames and resolver domains are reconstructed at runtime by joining literal fragments to evade static string matching. The package presents itself as an observability/metrics bridge, but the shipped behavior on import is download-and-execute of an opaque attacker-controlled binary, giving whoever published this full code execution on any host that installs or imports the package.

statist-browser-typed-client-sme.salary.web.metrics@20.5.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code