MAL-2026-12230

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246) On require of this package, index.js loads _vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), downloads a platform-specific binary via https.get, and falls back to a covert channel that reconstructs a base64 payload from numbered DNS TXT records under tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. The retrieved bytes are written to /tmp or %TEMP% under decoy names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and spawned detached via spawn('/bin/sh', ['-c', <path>+' &']) or cmd.exe /c start /b. A second module lib/telemetry.js, framed as an analytics SDK, ships the same base64-decode / chmodSync 0755 / detached spawn chain. The destinations are anonymous Cloudflare Workers subdomains and an unrelated DDNS-style domain; the fetched content is opaque native code executed on the installer's host with no verification.