registry / Remote code execution / twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info
twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info
API client bindings
This report shows the evidence for twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info@20.5.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete, automatically triggered remote payload download-and-execute chain unrelated to the declared API-client functionality. The lack of lifecycle hooks does not mitigate the import-time execution.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Runtime import/require of index.js.
Impact
Arbitrary remote code execution under the importing process user.
Mechanism
Remote binary download, DNS fallback, temporary-file drop, and detached execution.
Attack narrative
On ordinary package import, index.js silently requires _helpers.js. That module contacts obfuscated worker endpoints for a platform-specific binary, with DNS TXT reconstruction as fallback. If received, it drops the bytes to a temporary executable path, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe.
AI rationale
This is a concrete, automatically triggered remote payload download-and-execute chain unrelated to the declared API-client functionality. The lack of lifecycle hooks does not mitigate the import-time execution.
Evidence
package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_*C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_*.exe
Network endpoints8
oob-worker.cf100-416.workers.dev