MAL-2026-12038

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a) The package's main entry requires `./_ext`, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf102-baf.workers.dev), assembled at runtime from split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmod 0755'd, and spawned detached via `/bin/sh` or `cmd.exe`. No hash or signature verification. A DNS TXT-record fallback channel (`c.<domain>` chunk count plus numbered subdomains, base64-decoded and joined) retrieves the payload when HTTPS fails. Comments frame the behavior as 'telemetry' with `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` opt-out gates and a `.analytics_state` re-run cooldown marker; the package description ('Bigops customer abstraction layer') is generic and unrelated to the actual code. Destinations are anonymous serverless hosts unrelated to any publisher identity; the fetched code is opaque and runs with the installer's privileges as a consequence of `require('bigops-customer')`.