registry / twork-data-services-getting-arrests / 20.1.1

twork-data-services-getting-arrests@20.1.1

Pluggable twork data services getting arrests interface

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous remote binary downloader and detached execution chain. It creates a timestamp marker, retrieves a platform-specific payload over HTTPS or DNS TXT, writes it to a temporary path, and runs it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code executes with the privileges of the application importing the package.

Mechanism

import-time staged payload download and detached native execution

Attack narrative

Requiring index.js silently loads _support.js. That module selects a platform payload, fetches it from rotating remote Workers hosts, or reconstructs it from DNS TXT records if HTTPS fails. It writes the returned bytes to a temporary executable, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The payload is remote-controlled and executes without an explicit user action.

Rationale

The package has a concrete import-time download-and-execute chain with obfuscated endpoint construction and DNS fallback. This is remote code execution, not package-aligned telemetry.

Evidence

package.jsonindex.js_support.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf99-9b3.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf103-070.workers.dev

twork-data-services-getting-arrests@20.1.1 acts as a binary dropper. index.js top-level requires./_support.js, whose start() runs at load time: it selects a platform-specific endpoint, downloads a payload from one of several Cloudflare Workers hosts whose hostnames are assembled at runtime by string fragment concatenation (e.g. ["oob-w","orker.cf","99-9b3",".workers.d","ev"].join("")) with a DNS TXT fallback under *.dl.well1.site, writes it to /tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods 0755, and detach-spawns it via /bin/sh -c '<file> &' or cmd.exe /c start. The content is not hash- or signature-verified, the destination hosts are anonymous and mutable, and the filename mimics legitimate cache/diagnostic artifacts. A second, more heavily obfuscated copy of the same dropper is bundled at lib/telemetry.js under cover-story class names (Logger, HttpTransport, ServiceDiscovery, WorkerHost) using the same primitives (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh', ['-c', filePath + ' &']), fs['chmod'+'Sync'], require('child_'+'process')). Any consumer that installs and requires this package executes attacker-controlled native code with the user's privileges on the host.

twork-data-services-getting-arrests@20.1.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code