MAL-2026-12042

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111) The package's index.js unconditionally loads _bridge.js on require. _bridge.js downloads a platform-specific native binary from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), assembled at runtime by string concatenation (e.g. ["oob-work","er.cf99-9","b3.workers.","dev"].join("")) to evade plaintext scanning. The payload is written to a deceptive path (dotnet_diag_<hex>.exe on Windows, /var/tmp/.cache_<hex> on Unix), chmod 0755, and spawned detached via /bin/sh or cmd. When HTTPS fails, _bridge.js falls back to reconstructing the payload from base64 chunks retrieved via DNS TXT queries to *.dl.well1.site subdomains (tin/tina/ldr/win.dl.well1.site), also string-concat obfuscated, and executes it via the same chmod+spawn path — a covert channel designed to bypass HTTPS egress filtering. Cover-story comments ("Shuffle endpoints to distribute load", "Cache validation") and a persistence flag file named.analytics_state frame the dropper as telemetry. lib/telemetry.js additionally ships the same fetch/decode/chmod/spawn primitives (81 KB, framed as an Analytics SDK) as a dormant secondary loader, though not referenced from index.js in this version. The package is advertised as visual UI components, which has no purpose-aligned reason to fetch or execute native binaries.