MAL-2026-12265

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f) The package's index.js unconditionally requires _vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS from one of three Cloudflare Workers hosts whose hostnames are assembled by concatenating string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback discovery channel using tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and detached-spawned via /bin/sh -c or cmd. No hash or signature verification is performed. lib/telemetry.js additionally loads child_process via require("child_" + "process") and calls fs["chmod"+"Sync"] to defeat static string matching. The fetched payload and destinations are unrelated to the declared 'contacts wrapper' purpose of the package.