MAL-2026-12282

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8) On require of this package, _platform.js reconstructs endpoint hostnames from split string arrays via.join(""), downloads a platform-specific binary from oob-worker.cf99-9b3.workers.dev (with a DNS TXT chunked fallback resolver at tin.dl.well1.site), writes it to /var/tmp or %TEMP% under disguised names such as.cache_<hex> and dotnet_diag_<hex>.exe, invokes fs.chmodSync to set 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true}) or the Windows cmd equivalent. lib/telemetry.js, styled as a Sentry-like analytics SDK, bundles a parallel drop-and-execute path using the same disguised API calls (require('child_'+'process'), fs['chmod'+'Sync']) and base64-buffer construction. The destinations are not the publisher's infrastructure, the fetched bytes are not pinned or hash-verified, and identifier and env-var names such as analytics_state and telemetry opt-out flags serve as cover story for the dropper behavior.