MAL-2026-12069

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391) On require('nxify-unic'), index.js loads _shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and Array.join('') (Cloudflare Workers hosts oob-worker.cf100-416.workers.dev / oob-worker.cf102-baf.workers.dev / oob-worker.cf101-adf.workers.dev and a DNS-TXT chunked-base64 fallback at *.dl.well1.site), downloads a platform-matched binary with no hash or signature verification, writes it to /var/tmp or %TEMP% under decoy filenames such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via spawn('/bin/sh', ['-c', fp+' &']) or cmd.exe /c start /b. Destinations are anonymous workers.dev hosts unrelated to any declared publisher; endpoint strings are reconstructed at runtime to evade static analysis; a TTL cache and opt-out env-var gate re-execution. The behavior fires on module import, not at a user-invoked entry point.