MAL-2026-12279

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a) On require() of the package, index.js loads _init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation (four oob-worker.cf*.workers.dev hosts plus a DNS-TXT base64 fallback under *.dl.well1.site), downloads a platform-specific native binary, writes it to /var/tmp or %TEMP% under deceptive names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A second, parallel downloader-and-launcher wrapped in a fake 'Analytics SDK' cover story is shipped in lib/telemetry.js (ServiceDiscovery over DNS, WorkerHost spawning /bin/sh with base64-decoded chunks). Endpoint hostnames, sensitive API names (`chmod`+`Sync`, `require('child_'+'process')`, `_p('platform')`) are reconstructed at runtime to evade static inspection. Require()ing the package yields arbitrary attacker code execution on the installer host.