MAL-2026-13142

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9) On require() of the package, index.js loads _shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The fetched bytes are written to a temp path under decoy names (e.g. dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Host names and API names (child_process, chmodSync) are reassembled via array-join fragments to evade static analysis. A secondary dropper with equivalent base64-decode + chmod 755 + spawn '/bin/sh -c <file> &' logic is bundled in lib/telemetry.js (~81KB) under an 'analytics SDK' cover story. Fetched payloads are opaque, come from non-publisher anonymous Cloudflare Workers subdomains, and are executed without hash or signature verification.