registry / time-webkit-tag / 20.1.6

time-webkit-tag@20.1.6

Time webkit tag provider for microservice architecture

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package initiates a remote binary download and execution chain. The payload source can be changed remotely and is also obtainable through DNS TXT records.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary native code executes as the application user.

Mechanism

Remote payload download/write/chmod/detached execution with DNS fallback.

Attack narrative

Requiring index.js silently imports _init.js, which invokes start(). It retrieves a platform-specific payload from obfuscated workers.dev hosts, or reconstructs one from DNS TXT records, writes it into a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The temporary state stamp merely rate-limits the execution attempt.

Rationale

This is a concrete import-time remote-code-execution payload loader, not telemetry behavior. The lack of npm lifecycle hooks does not reduce the runtime compromise risk.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev/pkg/package/pkg/package

On require of the package, index.js loads _init.js which unconditionally invokes start(). start() selects a platform-specific asset path, assembles CDN hostnames from split string arrays (oob-worker.cf101-adf.workers.dev family, with a *.dl.well1.site DNS-TXT chunked-transfer fallback), fetches an opaque binary over HTTPS, writes it to /var/tmp or %TEMP% under a hidden dot-file or masquerading name (e.g..cache_<rand>, dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with.unref(). No hash or signature verification is performed and the destination hosts are assembled at runtime to evade static string matching. A second dropper implementation in lib/telemetry.js repeats the same fetch/base64-decode/chmod/spawn chain, with the chmodSync and child_process identifiers built via string concatenation (fs["chmod"+"Sync"], "child_"+"process") under an analytics-SDK cover story. The package is advertised as a webkit tag provider and has no legitimate need for this behavior.

time-webkit-tag@20.1.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code