MAL-2026-13119

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f) On require, index.js loads _ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts on the *.workers.dev and *.dl.wel1.ru namespaces (with a DNS TXT-record fallback that base64-decodes concatenated chunks into a binary), writes it to a temp directory under a masquerading name such as dotnet_diag_<hex>.exe on Windows or.cache_<hex> on POSIX, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, destinations are reconstructed at runtime from split substring arrays, and a secondary DNS-over-TXT loader provides resilience against domain blocking. Any consumer that require()s bpm-foundation-storage triggers execution of attacker-controlled code on the installer's host. The package's declared purpose is a storage library; none of the observed behavior is consistent with that purpose.