MAL-2026-12310

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027) The package's declared main (index.js) unconditionally requires./_init on load. _init.js selects a platform-specific asset (win32/darwin/linux_x64/linux_arm64) and downloads a native binary over HTTPS from a rotating pool of Cloudflare Worker hosts whose hostnames are reassembled at runtime from split-literal arrays (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback via *.dl.well1.site. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd on POSIX, and spawned detached via /bin/sh -c or cmd. child_process is loaded via require("child_"+"process") in lib/telemetry.js to evade static analysis. There are no lifecycle scripts required — any require() or import of this package triggers download and execution of an unpinned, unauthenticated remote binary from anonymous infrastructure, giving the publisher arbitrary code execution on the installer's host.