MAL-2026-13179

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1ee4e207fd01bae956d7fe084377ecea438f81774ea01ca6b02a50c1962c6cca) Package advertises itself as a React UI helper but its index.js unconditionally require()s./_vendor at load time. _vendor.js selects a platform-specific asset path, fetches bytes over HTTPS from a randomly-ordered pool of string-split-obfuscated hosts assembled via.join('') (oob-worker.cf*.workers.dev and sdk/ext/pkg/net.dl.wel1.ru), with a DNS-TXT chunked-base64 fallback to bypass HTTPS filtering. The downloaded bytes are written to /tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755'd on POSIX, and spawned detached via /bin/sh or cmd.exe. No hash verification is performed despite a cover-story comment claiming a SHA-256 integrity check. The package's declared 'interface elements' purpose is a cover story: index.js is a trivial no-op class stub, and the dropper is the only functional behavior.