registry / twork-products-taiga2-products-investment / 20.2.8

twork-products-taiga2-products-investment@20.2.8

Twork products taiga2 products investment provider for microservice architecture

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package automatically runs a remote binary downloader and detached launcher. It creates a temporary marker and executes a downloaded platform-specific payload.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Requiring/importing the package main entrypoint

Impact

Arbitrary native code execution under the importing user's privileges.

Mechanism

Remote payload download, temporary-file drop, and detached execution

Attack narrative

The public entrypoint suppresses errors while automatically requiring _init.js. That module fetches a platform-specific binary from obfuscated Workers hosts, or reconstructs it through DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached. This is an unconsented import-time remote-code-execution chain.

Rationale

The source implements concrete download-and-execute behavior on normal package import, with obfuscated endpoints and no integrity validation. The lack of npm lifecycle hooks does not mitigate this reachable runtime payload launcher.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require of the package, _init.js (unconditionally loaded from index.js) fetches a platform-specific executable from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev), with a base64-over-DNS-TXT fallback via tin.dl.well1.site. The C2 hostnames are runtime-assembled from split string arrays to evade static inspection. The fetched binary is written to a disguised temp path (dotnet_diag_<rand>.exe on Windows or.cache_<rand> on POSIX), chmod 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b, with a /tmp lock file gating re-execution. A second, currently-unreferenced dropper is also bundled at lib/telemetry.js under an 'analytics SDK' cover story, using string-concat require('child_'+'process') and the same fetch-write-chmod-spawn shape with a base64-chunked embedded buffer. ## Source: ghsa-malware (9afb4b01f9edbe6602852306ef2c992d952f1be24be95892df6edc3e078fadcd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

twork-products-taiga2-products-investment@20.2.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code