MAL-2026-12785

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a) On require(), index.js loads _support.js, which assembles Cloudflare Workers hostnames (oob-worker.cf*.workers.dev) and fallback domain sdk.dl.wel1.ru at runtime from split string arrays joined via.join(""), downloads a platform-specific binary from those hosts (with a DNS TXT chunked fallback via c.<domain>/i.<domain> records when HTTPS is blocked), writes the payload to a temp path with a disguised name (e.g. dotnet_diag_<rand>.exe,.cache_<rand>), chmods 0755 on POSIX, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). Execution is gated by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars and a /tmp/.analytics_state cache, framing the dropper as analytics. The advertised TokenManager API is a decoy — no relation to the download-and-execute behavior. Destination hosts are anonymous workers.dev / lookalike infrastructure, not the package's stated purpose or publisher.