MAL-2026-13135

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e) On package load, index.js requires./_platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with DNS-TXT fallback resolvers under *.dl.wel1.ru (sdk/ext/pkg/net). Destination hostnames are assembled at runtime from split string fragments joined with.join('') to evade static analysis. The fetched payload is written to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A marker file.analytics_state is written to throttle re-execution. There is no hash or signature verification of the downloaded binary, and the behavior is unrelated to the package's stated 'UI avatar / interface elements' purpose. The package name mimics the legitimate dolyame payment SDK ecosystem.