MAL-2026-13121

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319) On require() of the package, index.js loads _bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments (oob-worker.cf100-416/cf101-adf/cf102-baf.workers.dev) with a DNS TXT chunked base64 fallback via *.dl.wel1.ru, downloads a platform-specific executable, writes it to a hidden temp path (/var/tmp/.cache_<hex> on Unix, %TEMP%/dotnet_diag_<hex>.exe on Windows) chosen to imitate benign OS artifacts, chmods it 0755 on Unix, and detach-spawns it via spawn("/bin/sh",["-c", fp+" &"], {detached:true}) or cmd.exe /c start /b. A DISABLE_TELEMETRY-style env gate is used as cover. The package is named as a test harness but the fetched binary is opaque, purpose-mismatched, and executed unconditionally on import.