MAL-2026-12253

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1) On require of the package, _adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev) with DNS-TXT fallback to tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The destination hostnames and the child_process module name are assembled at runtime via array.join to evade static inspection. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod'd to 0755, and detach-spawned via /bin/sh -c or cmd /c start. A second module, lib/telemetry.js, contains the same dropper pattern (base64 chunk assembly, string-concatenated fs.chmodSync, cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true})) as a staged/redundant payload. Package naming and the analytics-SDK framing do not match the observed behavior, which is a runtime fetch-and-execute of attacker-controlled bytes on the installer's host.