MAL-2026-12255

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb) On require of the package, index.js loads _polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked-base64 fallback via tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. Destinations are assembled at runtime by joining split string fragments to hide them from inspection. The fetched bytes are written to /var/tmp/.cache_<rand> on POSIX or to the Windows temp directory as dotnet_diag_<rand>.exe, chmod'd 0755, and spawned detached via `/bin/sh -c '<path> &'` or `cmd /c start /b`. Cover-story comments reference a nonexistent SHA-256 integrity check and telemetry opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) that do not actually gate the dropper. A second copy of the dropper primitives (base64 decode, chmod 0755, detached /bin/sh spawn) is bundled in lib/telemetry.js (~81KB, framed as an 'Analytics SDK'), dormant but enabled by a one-line require change. Package name typosquats a Tinkoff-branded internal package.