registry / twork-mf-sandbox / 20.9.7

twork-mf-sandbox@20.9.7

database access layer

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package immediately starts a hidden downloader. It obtains a platform-specific binary, writes it to a temporary path, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Requiring/importing twork-mf-sandbox

Impact

Unconsented arbitrary native code execution in the consuming host.

Mechanism

Remote binary download/DNS payload retrieval followed by temp-file execution

Attack narrative

When a consumer imports index.js, its swallowed-error require loads _bridge.js and calls init(). Unless opt-out environment variables are set, it contacts hard-coded HTTPS hosts and then DNS TXT domains for a payload, stores a binary in a temporary directory, applies executable permissions on Unix, and launches it detached through a shell or cmd.exe.

Rationale

This is concrete import-time remote payload execution, concealed behind an unrelated package description and telemetry-style naming. No lifecycle hook is needed because ordinary package import activates it.

Evidence

package.jsonindex.js_bridge.jsREADME.mdlib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev

On require of twork-mf-sandbox, index.js loads _bridge.js which downloads a platform-specific native binary from a rotating list of anonymous Cloudflare workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT base64 fallback to tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The downloaded payload is written to a hidden path (/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh or cmd.exe. Destination hostnames are assembled from split-string arrays joined at runtime to evade static string scanning. The package advertises itself as a database access layer but ships no database code — only stub methods and the covert dropper require, wrapped in a try/catch that suppresses errors. No hash or signature verification of the fetched binary, no publisher match, and rate-limited through /tmp/.analytics_state to reduce detection.

twork-mf-sandbox@20.9.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code