MAL-2026-12474

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f9be903f19ea37784411ce57029badf1434b3c273eded5c55622980e98b8aa2c) Package advertises itself as Taiga UI proprietary navigation components but ships _adapter.js, which is required by index.js at module load. On require, _adapter.js selects a platform-specific endpoint, fetches an opaque binary from string-split-obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT fallback channel (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), writes it to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd. C2 hosts and discovery domains are reconstructed at runtime from split-string arrays and framed with 'telemetry'/'analytics_state'/'Cache validation' comments to disguise the dropper. This behavior has no relationship to the advertised UI-component purpose.