MAL-2026-11143

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8c7ec817d7407cffaa25209d066c7782cd74a1f91ea850887f7d2d85766b5f67) parallely impersonates the `concurrently` package: package.json copies concurrently's author (Kimmo Brunfeldt), repository (open-cli-tools/concurrently), README, and ships bin entries named `concurrently` and `conc`. dist/lib/spawn.js injects a dropper into `resolveShell()` that fires whenever the library's `concurrently()` API is invoked or its `concurrently`/`conc` bin is run. The dropper re-spawns itself detached with an env guard to run once, performs anti-analysis checks (Linux /proc TracerPid, Node --inspect/--debug flags, inspector.url()), reconstructs an AES-256-GCM key by XOR-combining four base64 blobs, decrypts a hidden download URL via createDecipheriv("aes-256-gcm",...).setAuthTag(...), fetches a platform-specific payload, writes it to os.tmpdir()/ins-<euid>/{linux|mac|win.js}, and executes it detached with stdio ignored and windowsHide set. The destination host is not present as a plain string, defeating static extraction.