MAL-2026-12411

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5) On require() of the package, index.js loads _loader.js which unconditionally executes init(). init() selects an OS-specific payload path, downloads an opaque binary via HTTPS from author-controlled Cloudflare Workers hosts (oob-worker.cf10x-*.workers.dev) with a base64-over-DNS-TXT fallback under *.dl.well1.site, writes the bytes to a disguised temp file (dotnet_diag_<hex>.exe on Windows or.cache_<hex> under /var/tmp), chmods 0755, and spawns it detached via spawn("/bin/sh") / spawn("cmd"). Destination hostnames are assembled at runtime from small string fragments joined with Array.join to defeat naive string scans. A cache-lock file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a ~6-hour TTL rate-limits re-execution across imports, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var checks serve as a telemetry cover story while the actual behavior is remote-binary drop-and-execute. The fetched bytes are attacker-controlled and unpinned (no hash, no signature, no vendor-matching publisher domain), so any consumer that requires this package runs whatever the operators serve at the moment of install/import.