MAL-2026-12444

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828) On require() of the package, _init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare workers.dev hosts whose names are reconstructed from split-string arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmods 0755, and spawns it detached via spawn('/bin/sh',['-c',fp+' &']) or spawn('cmd',...). A DNS-TXT fallback channel resolves numbered subdomains under dl.well1.site (also assembled from fragmented array joins) and base64-decodes the concatenated TXT records when HTTPS retrieval fails. A hidden stamp file (.analytics_state) with a ~6.3-hour TTL throttles re-execution to establish recurring background execution, and the code short-circuits only on well-known opt-out envs (DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK), impersonating legitimate telemetry artifacts. The package name and telemetry cover story do not match the observed behavior: fetching opaque attacker bytes and executing them detached is a canonical binary-runner dropper.