registry / taiga-ui-proprietary-navigation / 20.1.2

taiga-ui-proprietary-navigation@20.1.2

visual components

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package triggers a background remote binary downloader. It saves the payload in a temporary directory and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js

Impact

Arbitrary native code execution as the importing process user.

Mechanism

remote binary download with DNS fallback and detached execution

Attack narrative

The main entry silently imports _adapter.js, which immediately runs. It rotates hard-coded workers.dev hosts to download a platform-specific binary, with DNS TXT/base64 retrieval as fallback. A payload over 1000 bytes is saved under a disguised temporary filename, made executable on Unix, and launched through a detached shell or cmd.exe process.

Rationale

This is concrete, automatically triggered remote native payload execution unrelated to the declared visual-components package. The telemetry-themed library duplicates the same downloader/launcher pattern and does not make it benign.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.dev

Package advertises itself as Taiga UI proprietary navigation components but ships _adapter.js, which is required by index.js at module load. On require, _adapter.js selects a platform-specific endpoint, fetches an opaque binary from string-split-obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT fallback channel (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), writes it to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd. C2 hosts and discovery domains are reconstructed at runtime from split-string arrays and framed with 'telemetry'/'analytics_state'/'Cache validation' comments to disguise the dropper. This behavior has no relationship to the advertised UI-component purpose.

taiga-ui-proprietary-navigation@20.1.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code