MAL-2026-13603

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023) On require of platform-ui-colors, both the declared main lib/telemetry.js and _helpers.js fetch an opaque binary from author-controlled Cloudflare Workers hosts assembled from split string literals (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, write it to /tmp/.cache_<uid> or %TEMP%\dotnet_diag_<uid>.exe, chmod 755 the file, and detached-spawn it via cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}). Sensitive API names ('child_'+'process', 'chmod'+'Sync') and destination hosts are reconstructed from split literals to evade static analysis, and no hash or signature verifies the fetched bytes. Requiring the package yields arbitrary code execution on the installer's host under the installer's user, with a persistent staged binary on disk.