registry / tinkoff-statist-browser-typed-client-eventea.projects.smartcam / 20.6.3

tinkoff-statist-browser-typed-client-eventea.projects.smartcam@20.6.3

Cross-service smartcam adapter

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary loader. It fetches an unverified payload, writes it to a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Requiring/importing the package entrypoint.

Impact

Arbitrary code execution under the importing user's privileges.

Mechanism

remote payload download, disk drop, and detached shell execution

Attack narrative

The entrypoint suppresses errors while importing _loader.js. That loader fetches a platform-specific binary from rotating obfuscated hosts, or reconstructs one from DNS TXT records, saves it under a disguised temporary filename, marks it executable on Unix, then starts it detached via /bin/sh or cmd.exe. The unverified payload is remote-controlled.

Rationale

This is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, reinforcing intent.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf99-9b3.workers.dev/pkg/package

On require() of the package, index.js loads _loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose hostnames are reassembled at runtime from split string fragments (oob-worker.cf99-9b3.workers.dev, cf103-070.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev), with a DNS TXT-record base64 fallback across tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. A cache marker file named analytics_state /.analytics_state is used to gate re-execution. No hash or signature verification is performed on the downloaded binary. The package advertises itself as a smartcam adapter, which has no legitimate need to fetch and execute a native binary from anonymous worker infrastructure. A second, unreferenced module lib/telemetry.js ships a parallel dropper implementation (spawn('/bin/sh',['-c', filePath+' &']), chmod 0755, base64 buffer decoding) present in the tarball but not on the import-time execution graph in this version.

tinkoff-statist-browser-typed-client-eventea.projects.smartcam@20.6.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code