MAL-2026-12443

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e) On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via `.join('')` from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name (`dotnet_diag_<hex>.exe` / `.cache_<hex>`), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true})` (or `spawn('cmd',...)` on Windows). If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: `dns.resolveTxt` is called against `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site` (also assembled from split fragments), and the TXT record contents are concatenated and base64-decoded to reconstruct the payload bytes. A `checkStamp()` flag file gates re-execution and stderr writes are used as silent no-op logs. The fetched binary is unpinned, unsigned, and unrelated to the package's advertised SDK purpose.