MAL-2026-12297

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060) On require() of the package, index.js invokes setup() in _helpers.js which downloads a platform-specific native binary from split-string-obfuscated Cloudflare Workers hostnames (oob-worker.cf100-416/cf103-070/cf101-adf/cf102-baf.workers.dev) with a base64-over-DNS-TXT fallback via *.dl.well1.site, writes it to /tmp or %TEMP% under a hidden/disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and launches it detached via /bin/sh -c or cmd.exe /c start /b. Endpoint hostnames and sensitive API names (child_process, chmodSync) are assembled with.join("") over split fragments to evade static matching, and cover-story identifiers (analytics_state, telemetry, DISABLE_TELEMETRY) frame the behavior as opt-out telemetry. A parallel dropper implementation with the same download-write-chmod-spawn shape is bundled in lib/telemetry.js. The package advertises only 'API client bindings' and ships no legitimate reason to fetch and execute an opaque native binary.