MAL-2026-12276

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e) Package presents itself as a trivial event bus (index.js exports a small EventBus class) but its main entry unconditionally requires./_ext on load. _ext.js selects a platform-specific payload, downloads a binary from Cloudflare Workers hosts whose names are reassembled at runtime from split-string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT fallback under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site that base64-decodes chunked TXT records into a binary. The downloaded bytes are written to /tmp or %TEMP% under masqueraded names (dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on Unix, and spawned detached via cmd.exe or /bin/sh. Host strings and DNS discovery domains are concatenated from fragmented arrays to evade static analysis, and a no-op _l() function is scattered around the network I/O. The package name mimics an internal Tinkoff typed-client naming convention, consistent with a dependency-confusion attack against a private scope.