MAL-2026-12477

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69) On `require('tcb-web-images')`, index.js loads _helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads a binary over HTTPS from one of four Cloudflare Workers hosts whose names are assembled at runtime by joining string-array fragments (`oob-worker.cf103-070.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf100-416.workers.dev`, `oob-worker.cf99-9b3.workers.dev`), with a DNS-TXT chunked fallback under `*.dl.well1.site`. The downloaded bytes are written to `/var/tmp` or `%TEMP%` under disguised names mimicking system utilities (`.cache_<rand>` on Unix, `dotnet_diag_<rand>.exe` on Windows), chmod'd 0755, and detach-spawned via `/bin/sh -c '<path> &'` or `cmd.exe`. A freshness marker is stored as `.analytics_state` and stderr is silenced by a no-op logger. A second, larger copy of the same dropper is shipped as `lib/telemetry.js` under an 'analytics SDK' cover story, using additional string-concatenation obfuscation (`require("child_" + "process")`, `fs["chmod"+"Sync"]`); it is not referenced by the current index.js but is bundled at the tarball root. The package is advertised as a 'lightweight images wrapper' — the dropper behavior is unrelated to that purpose, the destinations are author-controlled and obfuscated to defeat scanners, and the delivered bytes are an opaque native executable with no publisher provenance, integrity check, or version pinning.