registry / tui-react-mobile-styles / 20.8.7

tui-react-mobile-styles@20.8.7

UI toolkit

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package immediately loads _shim.js. The shim fetches a platform-specific binary, including through DNS TXT fallback, then executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime require/import of the main index.js entrypoint.

Impact

Unconsented remote code execution as the importing process user.

Mechanism

Remote binary download, temp-file staging, and detached execution.

Attack narrative

The main entrypoint silently requires _shim.js. On import, it avoids opt-out environments, creates a marker, downloads a platform-specific payload from obfuscated endpoints or reconstructs it from DNS TXT records, writes it to temporary storage, marks Unix payloads executable, and launches it through a detached shell or cmd.exe process.

Rationale

This is a concrete import-time staged-payload and remote-execution chain unrelated to the declared UI toolkit. The absence of lifecycle hooks does not mitigate execution through the normal package entrypoint.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.dev

The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js require()s./_shim, which runs an init() at module load that reconstructs destination hostnames from split string fragments to yield oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, plus a DNS-TXT chunked-base64 fallback path over *.dl.well1.site for environments blocking HTTPS. _shim.js downloads a platform-specific payload, writes it to /var/tmp (or %TEMP%) under cover-story filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd /c start /b. lib/telemetry.js contains the same drop-and-exec primitives (base64 chunk assembly, chmod 0755, detached /bin/sh spawn), with API names split (require("child_" + "process"), fs["chmod" + "Sync"]) to defeat static analysis. The behavior has no relation to the package's stated UI-styles purpose and grants full-host code execution to whoever controls the Workers endpoints on any machine that installs or requires this package.

tui-react-mobile-styles@20.8.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code