MAL-2026-12258

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008) Requiring this package triggers _support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare workers.dev mirror hosts (assembled at runtime via.join('')) with a DNS-TXT chunked-base64 fallback channel on *.dl.well1.site, write the bytes to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmod 0755, and detach-spawn the binary via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed from split fragments; dropped filenames impersonate a dotnet diagnostic tool or hidden cache; module comments and environment variables named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK frame the code as analytics/telemetry as a cover story. The package name impersonates a Tinkoff-internal scope. Fetching and executing attacker-controlled bytes from non-publisher hosts at require time yields arbitrary code execution on the installer's host.