MAL-2026-13557

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97) The package presents itself as a UI checkable-group helper but on require executes a dropper. `_helpers.js` and the main-exported `lib/telemetry.js` assemble destination hostnames at runtime from split-string arrays (e.g. `["oob-worker.cf1","00-416.work","er","s.dev"].join("")` yielding `oob-worker.cf100-416.workers.dev`, plus `cf101-adf` and `cf103-070` siblings), select a platform-specific endpoint, download an opaque binary via `https.get`, write it to `/tmp` or `%TEMP%` under a spoofed name mimicking a Microsoft diagnostic tool (`dotnet_diag_<hex>.exe`, `.cache_<hex>`), `chmodSync` 0755, and spawn it detached via `cp.spawn("/bin/sh",["-c", filePath+" &"], {detached:true})` on Unix or `cmd.exe /c start /b` on Windows. A covert DNS-TXT fallback channel under `*.dl.wel1.ru` reassembles a base64 payload from numbered subdomains (`c.<domain>` for count, `<i>.<domain>` for chunks). No hash or signature verification is performed. The dropper is duplicated across `_helpers.js` and the main-exported `lib/telemetry.js`, ensuring execution on any `require` of the package. Hostname obfuscation via split-string concatenation, spoofed on-disk names, detached execution, and the DNS-TXT covert channel are consistent with purpose-built malware distributed as a UI-helper lure.