registry / tinkoff-statist-browser-typed-client-test.softwarecenter.metrics / 20.1.3

tinkoff-statist-browser-typed-client-test.softwarecenter.metrics@20.1.3

observability bridge

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the nominal metrics package triggers setup.js. It fetches an unverified executable payload, writes it to a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import of index.js, including normal application startup.

Impact

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Mechanism

Remote binary download and detached execution with DNS-TXT fallback.

Attack narrative

Normal import loads setup.js. Unless opt-out variables are set or a short-lived stamp exists, it retrieves a platform-specific blob from hard-coded HTTPS mirrors or encoded DNS TXT records, saves it under a disguised temporary filename, marks it executable on Unix, and launches it through a detached shell or cmd.exe. The large telemetry module duplicates this payload-loader behavior behind a purported native-profiler feature.

Rationale

This is a concrete, automatic remote payload execution chain unrelated to the documented metrics API. Absence of an install hook does not mitigate import-time execution.

Evidence

index.jssetup.jslib/telemetry.jspackage.jsonREADME.md/var/tmp/.cache_<random>C:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf100-416.workers.dev

The package's index.js requires./setup on module load. setup.js selects a platform-specific output path (/var/tmp/.cache_<hex> on unix, %TEMP%/dotnet_diag_<hex>.exe on Windows), fetches bytes over HTTPS from Cloudflare Workers hosts whose names are assembled at runtime from split-string fragments joined together (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with DNS TXT-record fallback destinations (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). The fetched payload is written to disk, chmod 0755 on unix, and spawned detached via /bin/sh -c or cmd.exe /c start. There is no hash or signature verification, no publisher relationship to the destination hosts, and no relationship between the fetched binary and any advertised functionality. Cover-story naming (analytics_state identifier, dotnet_diag_*.exe filename, DISABLE_TELEMETRY env-var opt-out) is used to mimic legitimate telemetry, and the package name typosquats a Tinkoff internal scope. The hostname obfuscation via.join("") on split fragments is a deliberate evasion pattern.

tinkoff-statist-browser-typed-client-test.softwarecenter.metrics@20.1.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code