MAL-2026-13176

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf) index.js unconditionally requires./_bridge on load. _bridge.js assembles Cloudflare Workers hostnames (oob-worker.cf10{0-3}-*.workers.dev) and a DNS-TXT discovery domain (sdk.dl.wel1.ru) from array-join string splits to hide them from static scanners, downloads a platform-specific binary over HTTPS, writes it to /var/tmp or %TEMP% under a cover-story name (.cache_<hex> / dotnet_diag_<hex>.exe), chmods it 0755, and detached-spawns it via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or spawn('cmd',...). The dropper is gated by opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) to evade sandboxed analysis. A parallel dropper is bundled at lib/telemetry.js under an 'Analytics SDK' cover story (base64-decoded payload chunks, chmod 755, /bin/sh -c spawn) that is not reached from the current require chain. Requiring or installing this package results in execution of attacker-controlled code from non-publisher infrastructure.