MAL-2026-13310

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee) The package `main` (`index.js`) requires `./_init` on load. `_init.js` assembles hostnames via string-split `.join('')` obfuscation to produce a rotating list of Cloudflare Workers endpoints (`oob-worker.cf103-070.workers.dev`, `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`) plus a DNS-TXT covert-channel fallback via `*.dl.wel1.ru` (`sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`). It downloads a platform-specific binary, writes it to `/var/tmp` or `%TEMP%` under disguised names (`dotnet_diag_<rand>.exe`, `.cache_<rand>`), sets mode 0755 on POSIX, and spawns it detached via `/bin/sh -c... &` or `cmd /c start /b`. Environment flags such as `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, and `DO_NOT_TRACK` act as kill switches. A second dropper is bundled in `lib/telemetry.js` (81 KB), which reconstructs a payload from base64-encoded DNS TXT chunks and executes it using the same detached-shell pattern, hidden behind `require('child_'+'process')`, `fs['chmod'+'Sync']`, and an `analytics-sdk` cover story. The package's advertised purpose has no relationship to any such native runtime.