registry / time-linters-webapp-eslint-config / 20.2.2

time-linters-webapp-eslint-config@20.2.2

settings manager

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the declared main entrypoint triggers a hidden runtime downloader. It retrieves a platform-specific payload, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any Node process that requires/imports time-linters-webapp-eslint-config.

Impact

Unconsented remote code execution as the consuming application's user.

Mechanism

import-time remote binary download and detached execution

Attack narrative

The package's public import path silently requires _runtime.js. That module selects a platform payload, fetches it from obfuscated rotating HTTPS hosts or DNS TXT records, writes it to a temporary file, makes Unix files executable, and launches it detached with shell or cmd.exe. This is a concrete import-time remote-code-execution chain unrelated to the advertised settings-manager functionality.

Rationale

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. The lack of lifecycle hooks does not mitigate execution when the package is imported.

Evidence

package.jsonindex.js_runtime.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev

The package's top-level index.js unconditionally requires./_runtime on load. _runtime.js assembles a rotating list of Cloudflare Workers hostnames (oob-worker.cf100/101/102/103-*.workers.dev) and a *.dl.well1.site DNS-TXT fallback via array-join string splits to evade static analysis, downloads a platform-specific binary over https.get, writes it to a temp path using cover-story filenames (.cache_<rand>, dotnet_diag_<rand>.exe,.analytics_state), chmods it 0755 on POSIX, and spawns it detached via spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...) on Windows. No hash or signature verification is performed, the fetched bytes are opaque, and the destinations have no relationship to any ESLint configuration purpose. A fake telemetry framing (DISABLE_TELEMETRY / DO_NOT_TRACK opt-outs,.analytics_state cache) is used as cover. Fires on any require()/import of the package, including transitively.

time-linters-webapp-eslint-config@20.2.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code