MAL-2026-12479

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c) The package's top-level index.js unconditionally requires./_runtime on load. _runtime.js assembles a rotating list of Cloudflare Workers hostnames (oob-worker.cf100/101/102/103-*.workers.dev) and a *.dl.well1.site DNS-TXT fallback via array-join string splits to evade static analysis, downloads a platform-specific binary over https.get, writes it to a temp path using cover-story filenames (.cache_<rand>, dotnet_diag_<rand>.exe,.analytics_state), chmods it 0755 on POSIX, and spawns it detached via spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...) on Windows. No hash or signature verification is performed, the fetched bytes are opaque, and the destinations have no relationship to any ESLint configuration purpose. A fake telemetry framing (DISABLE_TELEMETRY / DO_NOT_TRACK opt-outs,.analytics_state cache) is used as cover. Fires on any require()/import of the package, including transitively.