MAL-2026-13600

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8) On require('dolyame-ui-tableinline'), index.js loads _init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors (hostnames reconstructed at runtime via string-array.join("") to evade static matching), with a DNS TXT-record fallback to sdk.dl.wel1.ru. The binary is written to a disguised path under /tmp or %TEMP% (e.g., dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c "<path> &" or cmd /c start /b. A TTL marker file rate-limits re-execution. A second dropper (base64 buffer -> chmod 755 -> /bin/sh -c spawn) is duplicated inside lib/telemetry.js, the declared main module, wrapped in a fake SDK scaffold. Opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and cover-story file names (dotnet_diag_*,.analytics_state) are used as camouflage. The unpinned opaque native payloads, anonymous author-controlled hosts, obfuscated destination reconstruction, and detached background execution constitute full-host remote code execution on any machine that installs or imports the package.