MAL-2026-12213

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c) On require of this package, index.js loads _ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c or cmd /c start /b. Host arrays and API names are constructed at runtime by joining split fragments (e.g. require("child_"+"process"), fs["chmod"+"Sync"]) to defeat static string scanning, and comments frame the behavior as telemetry/analytics.