MAL-2026-13539

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49) On require of the package's main entry, `_helpers.js` runs a setup() routine that selects a platform-specific payload path via a `_DL_MAP` table and downloads an opaque native binary from Cloudflare Workers subdomains whose hostnames are assembled by joining split string fragments (e.g. ["oob-worker.cf103-070.wo","rke","rs",".dev"].join("")), with a DNS-TXT chunked fallback that reassembles a base64 payload from numbered TXT records under *.wel1.ru subdomains (sdk./ext./pkg./net.dl.wel1.ru). The downloaded bytes are written to `/var/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows, chmod 0755, and spawned detached via `spawn("/bin/sh", ["-c", fp + " &"], {detached:true})` or `cmd /c start /b`. The package advertises a trivial no-op class and ships no native source consistent with the download; the hostnames are unrelated to the declared purpose, there is no version pinning or hash/signature verification, and the destination assembly and DNS-TXT fallback are structured to evade static string scanners. The staging paths use hidden dotfile / diagnostic-lookalike names to blend with normal temp-file activity.