MAL-2026-12303

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7eba320ce2333e7bd477470ded20a2be52a334069c482ab957b41772f347f63d) On require of the package, index.js loads _compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback under *.dl.well1.site, downloads a platform-specific binary via https.get, writes it to /var/tmp or the Windows temp directory under a masquerading name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Misleading comments referencing an 'Analytics SDK', a 'DISABLE_TELEMETRY opt-out', and a 'SHA-256 integrity check' are present in the source; no such integrity check is implemented. A second copy of the same write-chmod-spawn dropper is staged in lib/telemetry.js (81 KB), reachable via dynamic loading. The require("child_"+"process") and fs["chmod"+"Sync"] patterns further evidence deliberate string-level evasion.