MAL-2026-12066

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109) On require(), _platform.js reconstructs destination hostnames from split-string arrays (e.g. 'oob-worker.cf103-070.workers.dev' assembled from ['oob-w','ork','er.cf103-070.','worker','s.','dev']) and downloads an unpinned platform-specific binary via https.get over a set of anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback resolved through *.dl.well1.site (e.g. 'tin.dl.well1.site' assembled from ['tin.dl.well1.','si','te']). The downloaded bytes are written to /var/tmp/.cache_<tok> on Linux or to the Windows TEMP directory as dotnet_diag_<tok>.exe, chmodded 0755, and spawned detached via spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or cmd /c start. A 'telemetry/analytics' cover story with a DO_NOT_TRACK opt-out and an analytics_state cooldown marker is layered around the drop-and-exec. No hash or signature verification is performed on the fetched binary.