MAL-2026-12784

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa) On `require('devplatform-spa-testing')`, index.js loads _platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from string-concatenated `oob-worker.cf*.workers.dev` hostnames (with a DNS-TXT-chunked base64 fallback via `sdk.dl.wel1.ru`), writes it to /tmp or %TEMP% under a disguised name (`.cache_<rand>` on POSIX or `dotnet_diag_<rand>.exe` on Windows), chmods 0755, and spawns it detached via `/bin/sh -c` or `cmd`. The C2 hostnames are assembled by joining fragments (e.g. `['oob-w','orker.cf102-','baf.worke','rs.d','ev'].join('')`) to defeat plain string scanning, and the dropper filenames plus cover-story comments about telemetry opt-out mask the behavior. The fetched bytes are attacker-controlled and executed on the installer's machine at import time.