MAL-2026-13304

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42) On require of the package, index.js unconditionally loads _bootstrap.js, which downloads a platform-specific binary from hostnames assembled via split-string concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with fallbacks to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru and a DNS TXT-record base64-chunk retrieval channel. The downloaded binary is written to /tmp or %TEMP% under a decoy hidden filename (.cache_<uid>, dotnet_diag_<uid>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names are runtime-assembled ("child_"+"process", "chmod"+"Sync") to defeat static scanners. A second, larger implementation of the same drop-and-exec pattern is shipped as lib/telemetry.js under an 'analytics SDK' cover story.