registry / tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web / 20.3.8

tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web@20.3.8

Web runtime support module

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the advertised package entrypoint silently runs a downloader. It retrieves an unverified platform binary, writes it to a temporary file, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime require/import of index.js

Impact

Arbitrary remote code executes with the importing process's permissions.

Mechanism

import-time remote binary download and detached execution

Attack narrative

At module import, index.js requires _bridge.js. Its run() function obtains a platform-specific binary over HTTPS from hard-coded workers.dev hosts, or reconstructs one from DNS TXT records, saves it under a disguised temporary filename, makes it executable on Unix, and launches it through a detached shell or cmd.exe process.

Rationale

The package's only advertised runtime API does not require telemetry, yet its entrypoint silently fetches and executes unverified remote bytes. This is a concrete import-time remote-code-execution chain.

Evidence

package.jsonindex.js_bridge.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package

On require of the package, index.js loads _bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT fallback via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The destination hostnames are assembled at runtime by splitting strings and joining them to evade static scanners. The fetched opaque bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and detached-spawned via /bin/sh -c or cmd.exe /c start. lib/telemetry.js ships a second copy of the same write-chmod-spawn dropper, additionally hiding child_process behind require("child_" + "process") and fs["chmod" + "Sync"] method-name concatenation, and framing the payload as an analytics SDK. There is no pinning, no hash or signature verification of the fetched executable, and the destinations are author-controlled Cloudflare Workers subdomains obfuscated in source — behavior consistent with a supply-chain dropper delivering arbitrary attacker-controlled code to the installer's host on require.

tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web@20.3.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code