MAL-2026-12232

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3) On require of the package, index.js loads _runtime.js which selects a platform-specific payload path, fetches an opaque native binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, cf101-adf, cf99-9b3, cf103-070.workers.dev) with a DNS-TXT chunked base64 fallback across hosts assembled from fragments (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). The downloaded bytes are written to /tmp or %TEMP% under randomized names disguised as system tooling (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Hostnames are reconstructed at runtime via Array.join to hide them from static inspection, and a silent stderr no-op is used to suppress logging. Behavior includes opt-out env checks, host shuffling, and a stamp file to run only periodically.