MAL-2026-12421

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d) On require('pvm-autodoc'), index.js loads _bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT base64 chunked fallback under *.dl.well1.site. The destination hostnames are constructed by string-splitting and joining at runtime to evade static analysis. The fetched bytes are written to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows (a name mimicking a Microsoft diagnostic tool), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. Opt-out variables and file naming are framed as 'analytics'/'telemetry' while the actual behavior is fetch-and-execute of an unpinned, unverified opaque native binary. A second file, lib/telemetry.js, is shipped in the tarball with the same fetch-decode-chmod-spawn primitives using concatenated API names ('child_'+'process', 'chmod'+'Sync') as a companion payload.