registry / twork-products-taiga2-products-mobile / 20.6.6

twork-products-taiga2-products-mobile@20.6.6

native bridge

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the main entrypoint silently executes a remote binary loader. It retrieves a payload from hard-coded HTTPS mirrors or DNS TXT records, writes it to a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary native code execution under the importing process's privileges.

Mechanism

Remote payload download, temporary-file drop, permission change, and detached execution.

Attack narrative

Requiring the package reaches _init.js without user opt-in. That module selects an OS-specific executable path, downloads a binary from obfuscated Workers hosts, and falls back to assembling a base64 payload from attacker-controlled DNS TXT records. It persists a short cooldown marker, drops the payload into a system temporary directory, grants execute permissions on non-Windows systems, and launches it through a detached shell or cmd.exe process.

Rationale

The package's import-time loader provides an unauthenticated remote-code-execution chain with concealed endpoints and no legitimate API linkage. This is concrete malicious behavior, independent of the scanner label.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require of this package, index.js loads _init.js which selects a platform-specific endpoint, reconstructs destination hostnames at runtime from split-string arrays (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, with a DNS-TXT chunked-base64 fallback under *.dl.well1.site), downloads an opaque native binary over HTTPS, writes it to /tmp or %TEMP% under cover-story names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored. There is no hash or signature verification. Additional anti-analysis features are present: hostnames are assembled at runtime to evade static string scans, dropped files use benign-looking diagnostic/cache names, a marker file.analytics_state is written, and telemetry-opt-out environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) are honored as a cover story for the binary drop. The Cloudflare Workers hosts and DNS fallback domains have no relationship to any legitimate publisher of this package.

twork-products-taiga2-products-mobile@20.6.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code