registry / twork-data-services-counterfree / 20.1.3

twork-data-services-counterfree@20.1.3

Pluggable twork data services counterfree interface

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the declared main entrypoint silently starts a remote payload downloader. It stores and executes the downloaded binary detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary attacker-supplied code executes under the importing process account.

Mechanism

Obfuscated HTTPS/DNS payload retrieval followed by local binary execution.

Attack narrative

The package main entrypoint catches and suppresses errors while importing _init.js. That module immediately fetches a platform-specific executable from rotating obfuscated Workers hosts, or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The payload is neither authenticated nor validated.

Rationale

This is concrete import-time remote code execution, not ordinary telemetry: fetched opaque bytes are executed without validation. The similar profiler loader in lib/telemetry.js reinforces the intentional payload-delivery design.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf102-baf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package/pkg/package

index.js unconditionally requires./_init on load. _init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from attacker-controlled Cloudflare Workers hosts whose hostnames are assembled at runtime by joining short string fragments (e.g. 'oob-worker.cf102' + '-baf.work' + 'ers.' + 'dev' → oob-worker.cf102-baf.workers.dev; sibling hosts oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev). If HTTPS mirrors are unreachable, the loader falls back to a DNS-TXT covert channel: it resolves TXT on c.<domain> under *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) to obtain a chunk count, resolves numbered subdomains to collect base64 chunks, and reassembles the payload. The bytes are written to /tmp or %TEMP% under deceptive names masquerading as system tooling (dotnet_diag_<rnd>.exe on Windows,.cache_<rnd> /.analytics_state on POSIX), chmod 0o755 is applied on POSIX, and the binary is spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() or the Windows cmd equivalent. Fires on require() of the package, so any consumer that installs and loads twork-data-services-counterfree executes attacker-controlled code with the installer's privileges.

twork-data-services-counterfree@20.1.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code