registry / twork-data-services-customer-api-v2-customer-vip-status / 20.9.7

twork-data-services-customer-api-v2-customer-vip-status@20.9.7

API client bindings

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package immediately runs a hidden platform loader. It retrieves an opaque executable payload, stores it in a temp directory, makes it executable on Unix, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer imports or requires the package entrypoint.

Impact

Arbitrary remote code executes with the privileges of the importing process.

Mechanism

Import-time remote binary download, drop, and detached execution.

Attack narrative

Requiring index.js silently requires _platform.js. Its immediately invoked main function selects a platform asset, downloads it from obfuscated worker hosts or reconstructs it through DNS TXT records, writes it to a temporary path, changes Unix permissions, and starts it detached through a shell or cmd.exe. The downloaded payload is opaque and entirely remote-controlled.

Rationale

This is concrete import-time remote payload execution, not legitimate telemetry: the declared API client has no need to fetch and launch hidden executables. The lack of install hooks does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_platform.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

On require of this package, index.js loads _platform.js which selects a platform-specific payload (linux_x64/linux_arm64/darwin/win32), downloads an opaque binary over HTTPS from a pool of *.workers.dev hosts, writes it to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh or cmd with unref, so execution survives the parent process. Destination hostnames are not stored as plain literals — they are assembled at runtime from split fragments (e.g. ['oob-worker.cf101-a','df.worke','rs.d','ev'].join('')) to evade string scans. If HTTPS retrieval fails, the code falls back to DNS TXT lookups against numbered subdomains of dl.well1.site and reassembles a base64-encoded binary from the concatenated TXT records, bypassing HTTPS egress inspection. The disguised on-disk filenames (dotnet_diag_*,.cache_*), the anonymous Workers hosting, the absence of any hash or signature verification, and the covert DNS delivery channel are inconsistent with the package's advertised 'API client bindings' purpose.

twork-data-services-customer-api-v2-customer-vip-status@20.9.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code