registry / tcb-web-copy-to-clipboard / 20.1.2

tcb-web-copy-to-clipboard@20.1.2

Tcb web copy to clipboard SDK for internal consumers

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package immediately activates a remote payload downloader. It stores and detached-executes an unverified platform-specific binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Remote code execution in the importing user's context.

Mechanism

Obfuscated remote binary download, DNS fallback, temp-file execution.

Attack narrative

Requiring index.js silently requires setup.js. That module retrieves a binary from obfuscated HTTPS hosts or reconstructed DNS TXT records, writes it under /var/tmp or Windows Temp, marks it executable on Unix, then starts it detached through a shell or cmd.exe.

Rationale

The advertised clipboard SDK has no legitimate need to silently retrieve and execute unverified native payloads at import time. This is concrete remote code execution, independent of the absence of install hooks.

Evidence

package.jsonindex.jssetup.jslib/telemetry.js

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf103-070.workers.devoob-worker.cf100-416.workers.devtin.dl.well1.site

The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes over HTTPS from one of four runtime-assembled Cloudflare Workers hosts (with a TXT-record DNS fallback under dl.well1.site), writes the response to /var/tmp or %TEMP% under a disguised name (Unix:.cache_<hex>; Windows: dotnet_diag_<hex>.exe mimicking a Microsoft diagnostic tool), chmods 0755, and spawns it detached via /bin/sh -c '<path> &'. Both the HTTPS hostnames and DNS domains are assembled by joining split string fragments (e.g. ['oob-worker.','cf101-','adf.workers.de','v'].join('')) to evade static string matching. A cover-story branch checks DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and writes a.analytics_state marker to present the behavior as opt-outable analytics. A companion lib/telemetry.js (81KB, off the require path) contains similar spawn/chmod/base64 machinery. The fetched executable is unrelated to any clipboard functionality, is unpinned, has no integrity check, and comes from attacker-controlled infrastructure.

tcb-web-copy-to-clipboard@20.1.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code