MAL-2026-12485

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c) On require('trapp-configuration'), index.js loads _adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three Cloudflare Workers hosts whose hostnames are reconstructed by joining character-split arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /tmp or TEMP under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via child_process spawn against /bin/sh or cmd. There is no hash or signature verification. When the HTTP mirrors are unreachable, _adapter.js falls back to a DNS-TXT covert channel against *.dl.well1.site (c.<domain> returns a chunk count, then numbered TXT queries at N.<domain> are base64-reassembled into the same payload) and executes the reconstructed binary. Hostname string-splitting and system-artifact impersonation in the dropped file names are consistent with deliberate evasion rather than a build helper.