MAL-2026-13155

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (be48c86f2b67912c3cfa1849431e5eb3d45510c55bb1fa98ab304dc36d25097b) On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS-TXT chunked base64 fallback resolved via sdk.dl.wel1.ru, writes it to /tmp or the Windows Temp directory under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods 755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. Destination hostnames and dangerous APIs are assembled by array-join and string concatenation (e.g. require("child_"+"process"), fs["chmod"+"Sync"]) to hinder pattern-matching. A second, structurally identical dropper is shipped in lib/telemetry.js under an 'Analytics SDK' label, providing a backup payload vector. The advertised purpose (a UI flag component) has no relationship to fetching and executing opaque native binaries from anonymous Workers hosts.