MAL-2026-12286

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661) On require of the package, index.js loads _bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from string-concatenation-obfuscated hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) assembled at runtime via array-join fragments, writes them to /tmp or %TEMP% under disguised names such as.cache_<rand> and dotnet_diag_<rand>.exe, chmods 0755, and spawns them detached via /bin/sh -c or cmd.exe /c start /b. If the HTTPS mirrors fail, _bridge.js falls back to a DNS TXT-record channel against tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, querying c.<domain> for a chunk count and then <i>.<domain> for base64 fragments that are concatenated, decoded, written to disk and executed as a native binary. The package's README advertises only a trivial in-process logger; the hostname obfuscation, per-OS payload selection, hidden temp staging with system-tool-mimicking names, detached spawning, and DNS-tunneled code delivery are exclusively attack behaviors and produce full-host code execution on any consumer that installs or requires this package.