MAL-2026-13634

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac) On require of the package, index.js loads _shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-string arrays (e.g. ["oob-worker.cf102-b","af.w","or","kers.","de","v"].join("") and ["pkg.dl.wel1.r","u"].join("")) targeting oob-worker.cf102-baf.workers.dev and sdk/ext/pkg/net.dl.wel1.ru, downloads a native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A DNS-TXT fallback channel (dns.resolveTxt on c.<domain>, 0.<domain>, 1.<domain>,...) reassembles and base64-decodes a payload when HTTPS retrieval fails, bypassing HTTP egress controls. lib/telemetry.js, loaded from index.js and presented as an observability/Sentry-like SDK, contains the same base64-materialize + chmodSync + child_process.spawn("/bin/sh",...) dropper primitives, providing a duplicate execution path. child_process, chmodSync, and endpoint hostnames are reconstructed at runtime from concatenated fragments to evade static scanners. No integrity check or pinned publisher-owned source; the fetched bytes are opaque and unverifiable.