MAL-2026-11141

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267) The package's main entry `index.mjs` presents itself as a math helper but contains a top-level async IIFE that runs on any `require`/`import` of the module. All network destinations, filesystem paths, subprocess names, and Node built-in module names are stored as integer arrays and reconstructed at runtime via a char-code decoder `_D(a) = String.fromCharCode(...a.map((c,i)=>((c-_K[i%3])+256)%256))` with `_K=[11,23,47]`, hiding `fs/promises`, `path`, `child_process`, and `node-fetch` from static inspection. Decoded, the block downloads `https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz` into a hidden directory under `AppData/Local/Microsoft/Windows/syscache/helper/`, extracts it with `tar -xzf`, and executes the dropped payload. On Windows, the target user profile is located by scanning `/mnt/c/Users` (WSL), and a launcher `env-setup.cmd` is written into `AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/` so the dropped `vite.exe` auto-launches on every login. On Linux, a `background-service` binary is written to the same hidden path, `chmod 0o755`d, and spawned with `stdio: 'ignore', detached: true` followed by `.unref()`, surviving the parent process. The package's advertised math-library purpose is unrelated to the code that actually runs on import.