MAL-2026-13288

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336) On load, index.js requires./_loader.js which reconstructs anonymous host names via array-join obfuscation (['oob-worker.cf100-416.work','ers.','dev'].join('') and ['sdk.dl.wel','1.','ru'].join('')), selects a platform-specific payload path, downloads an opaque binary from those hosts with a DNS-TXT fallback via *.dl.wel1.ru, writes it to /var/tmp/.cache_<hex> on Unix or TEMP\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd. A marker file gates re-runs and env-var checks provide a cover-story opt-out. lib/telemetry.js repeats the same shape using string-concatenation obfuscation for require('child_'+'process') and fs['chmod'+'Sync']. No hash or signature verification is performed; the destinations are anonymous, mutable CDN hosts unrelated to any declared purpose. Filename shape (dolyame-boxy-atom-bnpl-info-card) is also consistent with a lookalike/lure name.