MAL-2026-13532

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e) On require() of the package, index.js loads _helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru. The destination hostnames are assembled via array.join('') string-splitting to evade static indicator scanning. The fetched payload is written to /tmp or %TEMP% under a disguised filename (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod'd 0755, and spawned detached via spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',...). There is no hash or signature verification of the downloaded binary; the destinations are not publisher-controlled; opt-out is disguised as a generic DISABLE_TELEMETRY environment variable. The dropper is reachable from the package main entry at import time, so a plain `npm install` followed by any `require()` of the package executes attacker-controlled native code on the installer's host.