MAL-2026-12489

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df) The package advertises itself as a React tooltip UI component, but `index.js` (declared `main`) unconditionally requires `_loader.js`, which on module load downloads a platform-specific binary from hardcoded hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes it to `/tmp` or `%TEMP%` under disguised names (`.cache_<rnd>`, `dotnet_diag_<rnd>.exe`), chmods it 0755 on POSIX, and spawns it detached via `/bin/sh -c` or `cmd.exe start /b`. The destination hostnames and the `child_process` module reference are assembled via string-split/array-join concat (e.g. `["oob","-worker.cf103-070.","workers.de","v"].join("")`) to evade static string scanners. A TTL marker in the temp directory suppresses re-execution. Sibling file `lib/telemetry.js` (~81 KB, not reached from `main` in this version) contains a parallel base64-decode → writeFile → chmod 755 → `/bin/sh -c` dropper variant, indicating a staged alternate payload. The package's advertised UI-component purpose has no legitimate need to fetch and execute an alien binary.