MAL-2026-12237

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3112d2ca5a8472fa34cd7ca06332803889f72a195a05b3f98592e43decd66631) The package's index.js unconditionally requires _bootstrap.js on load. _bootstrap.js selects a platform-specific path (linux_x64, linux_arm64, darwin, win32), fetches an opaque binary from Cloudflare Workers hosts under oob-worker.cf10*.workers.dev whose names are reassembled at runtime via array-join to evade static inspection, and includes a DNS TXT chunked fallback channel using tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The downloaded bytes are written to /tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod 0755 on unix, and spawned detached via spawn("/bin/sh", ["-c", path + " &"]).unref() (spawn("cmd",...) on Windows). A marker file named.analytics_state gates repeat execution on a ~22374 second cooldown, and opt-out environment variables are honored in a way that mimics legitimate telemetry. A secondary module lib/telemetry.js contains the same dropper primitives with property-name obfuscation (fs["chmod"+"Sync"], require("child_"+"process"), Buffer.from(chunks,"base64")) alongside spawn("/bin/sh", ["-c", filePath + " &"]). The name tinkoff-codeceptjs-storyshots-alpha impersonates a well-known corporate scope; there is no legitimate reason for a storyshots testing helper to fetch and execute an opaque native binary from an anonymous Cloudflare Workers host at import time.